ClawHub

现象描述：校验skill是否合格

Security checks across malware telemetry and agentic risk

Overview

This skill is a local quality-audit helper for reviewing Codex skill folders, and its files match that purpose without hidden network, credential, persistence, or destructive behavior.

This appears safe to install for its stated purpose. It will read files in any skill folder you ask it to audit, so avoid pointing it at unrelated private directories. The publisher is not a trusted @openclaw publisher and VirusTotal was still pending, but the artifact evidence and static scan do not show suspicious behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The description is broad enough to trigger on many generic requests about reviewing or evaluating a skill, which can cause unintended invocation of this skill outside its narrow intended context. Over-broad activation increases the chance that an agent applies the wrong workflow, reads unrelated files, or produces misleading assessments when another skill or general reasoning would have been more appropriate.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger examples are everyday phrases like 'Review this skill' and 'give me a verdict,' which are likely to overlap with many normal user requests and spur unintended activation. Ambiguous triggers can route tasks to this skill when the user did not provide a skill folder or did not want a formal rubric-based audit, degrading reliability and potentially broadening file-access behavior.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal