ClawHub
Back to skill

Security audit

usage-logging

Security checks across malware telemetry and agentic risk

Overview

This skill is a documentation-style helper for adding local usage logs and audit trails, with privacy caveats users should manage before enabling it.

Install only if you want agents or skills to keep local operational logs. Before using it, decide what metadata is allowed, avoid logging secrets or personal data, set a retention or cleanup policy, and review the external leyline plugin if you plan to install the full plugin experience.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger list contains very broad single-word activators such as "logging," "usage," "audit," "metrics," and "analytics," which are likely to match ordinary user requests and cause unintended skill activation. In a logging-related skill, accidental activation is risky because it can introduce persistent data collection or file writes in contexts where the user did not explicitly ask for tracking or audit behavior.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The invocation phrasing includes an incomplete and ambiguous trigger, especially the fragment "or cost tracking to a skill," which does not clearly define when activation should occur. Ambiguous activation criteria increase the chance that the skill will be invoked in unrelated conversations, potentially leading to unwanted logging recommendations or persistence behavior.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill promotes persistent usage logging and audit trail storage, including a default local path, but does not warn that operational metadata may be retained on disk across sessions. In context, this is more dangerous because the skill is specifically designed to capture session, operation, token, duration, and metadata fields, which can create privacy, confidentiality, and compliance issues if users are unaware of retention and file-write behavior.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document defines structured logging schemas and examples for session, service, operation, error, and metadata fields, but it gives no guidance to avoid logging secrets, personal data, file paths, prompts, or raw error contents. In a usage-logging skill, this omission is risky because implementers are likely to copy these schemas directly, causing sensitive data to be persisted and easily queried at scale.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.