ClawHub
Back to skill

Security audit

progressive-loading

Security checks across malware telemetry and agentic risk

Overview

This is a coherent instructional skill for progressive module loading, with no hidden execution or data access, though users should treat its publishing examples carefully.

Installers should expect a documentation-style skill that helps agents decide which reference modules to load. Before copying commands from the packaging or mutation examples, confirm the target repository, package index, branch, and credentials; especially prefer TestPyPI before any public PyPI upload.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger list contains broad, generic activation terms such as "modularity," "context-management," and "token-optimization" that could cause this skill to activate in many unrelated conversations. Because the skill governs loading behavior and references additional modules, overbroad activation increases the chance of unnecessary context injection, unintended influence over agent behavior, and expansion of the effective attack surface.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The module includes `twine upload dist/*` and `twine upload --repository testpypi dist/*` as copyable publishing commands, but it does not explicitly warn that the first command uploads publicly to PyPI and can permanently expose a mistaken release. In a skill intended to guide packaging workflows, users may execute commands verbatim, so the omission increases the chance of accidental public publication.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.