ClawHub
Back to skill

Security audit

code-search

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple GitHub code-search guide with overly broad triggers, but it does not install code, persist, read private data, or perform high-impact actions.

Install this if you want an agent to look for public GitHub implementations or prior art. Be aware that its generic triggers may make it activate during ordinary coding or search requests, so review when it is invoked and avoid using it for private local codebase searches.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger list contains broad, high-frequency terms like "github", "code", and "search", plus a natural-language phrase that could match many ordinary requests. This can cause unintended activation of the skill during unrelated conversations, leading the agent to invoke external search behavior when the user did not explicitly request it.

Overly Broad Trigger

Low
Category
Trigger Abuse
Confidence
98% confidence
Finding
The trigger "code" is extremely common in developer conversations and is not specific to GitHub search. As a result, the skill may activate in many unrelated contexts, causing misrouting of user intent and potentially unnecessary external lookups.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
93% confidence
Finding
Using "search" as a trigger risks colliding with built-in or other agent search commands because it is both generic and likely reserved in many environments. This can shadow expected behavior, confuse routing, and cause the wrong tool or skill to run.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.