ClawHub
Back to skill

Security audit

harnrss 结构化能力框架

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple Chinese planning framework that changes response structure but does not run code or access data.

Install this if you want an harnrss-style structured planning aid. Be aware that broad Chinese requests for structured thinking may invoke it, but the reviewed artifact is markdown-only and shows no code execution, credential use, data access, or persistence.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill uses broad natural-language trigger phrases such as requests to think or plan "structurally," which can overlap with ordinary user prompts and cause the skill to activate unintentionally. This increases the chance of prompt-routing conflicts, unexpected behavior, or instruction shadowing when a user did not explicitly intend to invoke this skill.

Natural-Language Policy Violations

Medium
Confidence
87% confidence
Finding
The skill content is written to operate in Chinese and does not provide a mechanism to respect the user's language preference, which can override normal conversational expectations and reduce usability or transparency. While not directly security-critical, forced language/style behavior can obscure instructions, complicate review, and interact poorly with other skills or user intent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.