ClawHub
Back to skill

Security audit

purple-cow-content

Security checks across malware telemetry and agentic risk

Overview

This is a marketing-writing guidance skill with broad activation wording but no hidden code, persistence, credential access, or destructive behavior.

Install this if you want a strong marketing and social-content lens. Be aware it may steer some general writing requests toward punchier, promotional, or virality-focused output unless you explicitly ask the agent not to use that style.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The top-level description is broad enough to activate on general writing, engagement, virality, or marketing discussions, not just narrowly scoped content-generation tasks. This can cause the skill to intervene in unrelated conversations and override more appropriate domain skills or user intent, leading to prompt-routing errors and undesired behavior.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The catch-all Mode A trigger ('Any brainstorm, strategy, or planning discussion touching attention, audience, or messaging') is highly ambiguous and can match a wide range of ordinary business or communication discussions. Over-broad conversational activation increases the chance of accidental invocation, causing the assistant to apply this skill's framing where it is not appropriate and potentially suppress better-suited guidance.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The Mode B trigger includes 'Any explicit request to produce a piece of content,' which is too general because many content-generation requests have nothing to do with the Purple Cow marketing lens. This can lead to over-application of a specific persuasive style to neutral, technical, or otherwise unsuitable writing tasks, creating routing confusion and inconsistent assistant behavior.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.