ClawHub
Back to skill

Security audit

qwen-delegation

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Qwen CLI delegation guide; its main risk is that it may send selected files to Qwen when the user runs the shown commands.

Install only if you intend to use Qwen CLI for delegation. Review file globs before running examples, because included files may be sent to the configured Qwen provider, and keep API keys in your normal secret-management flow rather than hard-coding them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list contains very generic terms such as "cli" and "delegation", which are likely to collide with ordinary user requests and unrelated skills. In an agent ecosystem, overly broad activation can cause this skill to be invoked unintentionally, increasing the chance of unnecessary command guidance, wrong-tool routing, or exposure of users to shell-oriented workflows they did not request.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.