ClawHub
Back to skill

Security audit

aicreat

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed NocoBase administration helper, with some activation-scope cautions but no evidence of hidden or malicious behavior.

Install this only if you intend to manage NocoBase AI employees. Before applying changes, confirm the target employee, page or block, tool bindings, and any delete/update action; keep database, form-fill, and workflow permissions least-privilege.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list includes very broad, high-frequency terms such as "chatbot", "头像", and "浮动按钮", which can cause the skill to activate in contexts unrelated to AI employee management. This can lead to unintended tool exposure or execution paths when a user is discussing generic UI elements or chat features rather than requesting this specific skill.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal