ClawHub
Back to skill

Security audit

skill-validator-omni

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed validation tool that reads skill repositories to check standards compliance and does not show hidden data access, persistence, or destructive behavior.

Before installing, be aware that running the npx command will fetch and execute the published npm package; use the bundled local script if you want to inspect exactly what runs. Give it an explicit skill or repo path so it only validates the intended project.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill advertises very broad activation conditions such as requests to 'validate', 'audit', 'check', 'lint', or 'certify' a skill. In a multi-skill agent, these generic triggers can cause the validator to be invoked for routine requests where the user did not intend a full repository or skill audit, increasing the chance of context overreach and unintended processing of local files or repo structure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.