ClawHub
Back to skill

Security audit

阳明心学

Security checks across malware telemetry and agentic risk

Overview

This is a philosophy and self-reflection skill that may discuss personal dilemmas and generate an HTML report, but it does not show hidden access, exfiltration, or system modification.

Install if you want Yangming/Xinxue-based philosophical reflection. Avoid entering names, employers, health details, or other private facts unless you are comfortable with them appearing in a generated report.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list includes broad everyday distress phrases such as inner anxiety, mental exhaustion, and workplace confusion, which can cause the skill to activate in situations far beyond a narrow Yangming philosophy intent. That increases the chance of the agent engaging on sensitive emotional topics unexpectedly, possibly bypassing better-scoped skills or safeguards for mental-health-adjacent conversations.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The description states that any XinXue-related question, confusion, or scenario will be handled automatically, which leaves activation boundaries unclear and encourages over-collection of user context. In practice, ambiguous routing can cause the skill to absorb broad personal-problem discussions that may not be appropriate for a philosophy assistant.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill promises structured analysis and interactive HTML reports for user dilemmas without warning that sensitive personal details may be included in the rendered output. If the report is displayed, stored, or shared, it could expose private information about emotional distress, relationships, work problems, or other personal circumstances.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The HTML report template explicitly centers the user's problem diagnosis, scenario analysis, action checklist, and related quotes, but provides no controls for redaction or sensitivity handling. Because the skill is designed for personal dilemmas, the output can easily become a packaged disclosure of private information that is more shareable and persistent than plain chat text.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.