ClawHub

Opinion Analyzer — 多视角舆情分析助手

Security checks across malware telemetry and agentic risk

Overview

This appears to be a Chinese-language public-opinion analysis skill with some routing and language-scope caveats, but no evidence of hidden access, persistence, credential handling, or harmful behavior.

Install this if you want a Chinese-oriented public-opinion or brand-reputation analysis workflow. Be aware it may trigger on broad opinion-related prompts, and review any web-sourced conclusions for accuracy and bias before relying on them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrases are broad enough to match ordinary user requests about opinions, events, or public sentiment, which can cause the skill to activate when the user did not explicitly ask for this specialized workflow. Over-broad activation can reroute normal conversations into web-search-based analysis, increasing the chance of unintended data retrieval, misleading synthesized claims, or user confusion about why the skill was invoked.

Natural-Language Policy Violations

Medium
Confidence
80% confidence
Finding
The skill metadata and trigger wording are written only in Chinese and implicitly assume Chinese-language interaction, without stating fallback behavior for users in other languages. This can cause incorrect routing, poor user comprehension, and accidental invocation or exclusion based on language rather than user intent, which is a safety and usability issue though not a direct exploit path.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal