ClawHub
Back to skill

Security audit

error-patterns

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only error-handling skill with some broad activation and logging examples users should apply carefully.

Install only if you want reusable error-handling guidance. When adapting the examples, narrow activation where possible and add redaction or allowlisted fields before logging context or sending alerts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list uses very broad terms such as 'errors', 'debugging', and 'recovery', which are likely to match many ordinary user requests and cause this skill to activate outside its intended scope. Over-broad activation increases the chance of inappropriate guidance, prompt-surface expansion, or interference with other skills, especially because this skill is meant to influence error handling across plugins.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The logging example serializes and records the full `context` object and raw error message without any redaction, filtering, or guidance about sensitive-data handling. In an error-recovery skill, execution context commonly includes prompts, credentials, tokens, file paths, request payloads, or user data, so this pattern can leak sensitive information into logs and downstream alerting systems.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.