ClawHub

dabafvarvadfvavaevad

Security checks across malware telemetry and agentic risk

Overview

This DOCX skill appears purpose-aligned, but it can run local document tools and change or create files, so users should work on copies and review outputs.

Install only if you need DOCX editing or analysis workflows. Keep backups of important documents, use separate output filenames, review generated tracked changes and final documents, and verify any missing helper files or local dependencies before letting the agent run commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger description is broad enough to activate on generic document-related requests, which can cause the agent to select this skill in situations where users did not specifically request DOCX manipulation. Overbroad activation increases the chance of unnecessary file operations, shell command suggestions, and unintended tool use in contexts that may require a more constrained workflow.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The editing workflow instructs unpacking, modifying, and repacking existing documents without warning about overwriting originals or creating irreversible changes. In an agent setting, that omission can lead to destructive file modification, loss of forensic traceability, or accidental alteration of user-provided documents.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The conversion workflow generates PDFs and page image files on disk but does not warn that derivative artifacts will be created and may persist after analysis. This can expose sensitive document contents in additional files, increase data retention, and surprise users expecting read-only inspection.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal