ClawHub
Back to skill

Security audit

设计走查

Security checks across malware telemetry and agentic risk

Overview

This skill is a design review helper that reads selected design and page files to produce a compliance report, with no executable code or hidden background behavior.

Install this if you want an agent to review generated pages against a design spec. When using it, provide only the intended Markdown spec and page/CSS files, because the review requires reading those files fully.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill is configured to trigger not only on explicit user requests but also after generating any HTML/CSS page, which makes activation overly broad. This can cause unsolicited reading of project files and unexpected review behavior, increasing the chance of processing sensitive or unrelated local content beyond the user's immediate intent.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The proactive trigger condition is ambiguous because it instructs the skill to activate after page generation and ask whether review is needed, without clear boundaries on frequency or scope. In agent environments, vague proactive behavior can lead to unnecessary file inspection, user confusion, or unintended chaining into broader workspace access.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.