ClawHub
Back to skill

Security audit

Journal Abbrev

Security checks across malware telemetry and agentic risk

Overview

This is a coherent journal-abbreviation tool that uses expected public lookup services, local cache files, and BibTeX output generation without hidden or destructive behavior.

Install if you want journal abbreviation and BibTeX journal-field tooling. Expect network access to public journal data/lookup services on first use or fallback lookup, and use --dry-run before BibTeX processing when working with important citation files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Low
Confidence
86% confidence
Finding
The README explicitly states that the tool will automatically download data on first run and can rebuild/download caches, but it does not clearly warn users that these commands initiate network access. In an agent skill context, undocumented outbound network behavior can surprise users, violate offline expectations, and cause unintended data egress or policy violations even if the feature itself is legitimate.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger list is broad enough to activate on generic phrases like 'journal name' or citation-related requests, which can cause the skill to run when the user did not actually ask for abbreviation processing. Over-invocation increases the chance of unnecessary file or network operations and may route user tasks into a tool-enabled workflow without clear intent.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation advertises `bib` commands that modify or generate BibTeX outputs, but it does not clearly warn that running them may write files unless `--dry-run` or an explicit output path is used. In an agent setting, ambiguous documentation around write behavior can lead to unintended modification of user citation data or silent creation of output files.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.