ClawHub
Back to skill

Security audit

Meme Master

Security checks across malware telemetry and agentic risk

Overview

This instruction-only meme chat skill is coherent and non-executable, but it may keep a small local meme library and usage index.

Install only if you are comfortable with the agent maintaining a small workspace-local meme folder and index. Disable or avoid passive collection for private channels, do not save personal or sensitive images, and periodically review or delete <workspace>/memes/ if retention matters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The manifest description is broad enough to trigger on ordinary image-related or casual-chat situations, which can cause the skill to activate outside its intended niche. Over-broad activation increases the chance that image handling, meme interpretation, or meme-library behaviors are applied in contexts where the user expected literal analysis or no retention behavior at all.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly allows passive collection and storage of memes the agent receives from the user or encounters through other channels, but it does not require clear notice, consent, or retention boundaries. This creates a privacy risk because images may contain personal, identifying, or context-sensitive content that gets persisted in the workspace without the user's awareness.

Missing User Warnings

Low
Confidence
93% confidence
Finding
Maintaining `last-used`, `times-used`, and notes in `meme-index.md` creates behavioral metadata about user interactions and agent usage patterns without any user-facing warning or retention policy. While lower impact than storing the images themselves, this still persists interaction history that could reveal preferences, recency of conversations, or other usage patterns.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.