ClawHub
Back to skill

Security audit

skill-authoring

Security checks across malware telemetry and agentic risk

Overview

This is a text-only skill-authoring guide with some caution-worthy guidance, but no hidden execution or purpose-mismatched behavior.

Before installing, narrow the triggers if possible, review any deployment command before running it, and avoid saving raw private transcripts, credentials, customer data, or proprietary code in skill test files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list includes broad terms such as "writing" and "validation" that are likely to match many unrelated user requests, causing this skill to activate outside its intended scope. Over-broad activation is not code-execution dangerous by itself, but it can steer the agent into applying persuasive or process-heavy guidance in inappropriate contexts, increasing prompt-surface risk and degrading reliability.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The checklist includes deployment commands that create git tags, push to a remote, append to CHANGELOG.md, and copy files into ~/.claude/skills without an explicit warning that these commands modify local state and may publish changes externally. In an agent skill context, users may copy or execute these commands with limited scrutiny, which can lead to unintended repository changes, disclosure through remote pushes, or filesystem modifications.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This guidance explicitly tells authors to capture full subagent responses verbatim and later recommends pulling baseline prompts from real session transcripts, but it provides no privacy guardrails, redaction requirements, or retention limits. In a testing workflow, that can cause sensitive prompts, secrets, personal data, or proprietary code to be copied into test corpora and persisted under the skill directory, increasing exposure through source control, sharing, and later review.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Content
### Meincke et al. (2025): Persuasion Doubles Compliance

**Study**: Persuasive Paraphrasing in Large Language Models

**Key Finding**: Incorporating persuasion principles into instructions doubled compliance rates:
- **Baseline**: 33% compliance with standard instructions
Confidence
93% confidence
Finding
Model; LLM; model; You must follow these rule

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.