ClawHub
Back to skill

Security audit

Lay Press Release Writer

Security checks across malware telemetry and agentic risk

Overview

This is a local drafting skill for academic press releases, but users should treat generated quotes and media contacts as unverified placeholders.

Use this only as a press-release drafting aid. Review the generated summary against the paper, replace any generated quotes and media contact details with approved real information before publication, and run the local Python script only with inputs and output paths you intend to use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The file presents archived audit statements asserting the workflow stayed within scope and avoided overclaims, yet elsewhere records a failed stress case specifically for scope and boundary guidance. This inconsistency can mislead deployers into trusting a safety posture that the same evidence contradicts, weakening review controls and increasing the chance of unsafe or out-of-scope behavior being shipped.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The final assessment marks the skill as deployment-ready and deployable despite dynamic testing showing failed assertions for staying within declared scope and providing required boundary guidance. A false-ready status is dangerous because downstream users may skip deeper review and deploy a skill that can drift beyond intended academic-writing boundaries or make unsupported claims.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The activation guidance is broad enough to match many generic academic-writing requests, which increases the chance this skill is selected outside its narrow intended use. Over-broad routing can expose users to unnecessary script execution, mismatched transformations, or unsafe handling paths when a less-privileged or more appropriate skill should have been used.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.