ClawHub
Back to skill

Security audit

Hobbes

Security checks for vulnerabilities and agentic risk

Overview

This is a simple Thomas Hobbes roleplay skill with no tools, code execution, credentials, persistence, or data access.

This skill is suitable to install if you want a Hobbes-style conversational persona. Be aware that mentioning Hobbes may invoke the persona unintentionally; use explicit invocation such as /hobbes when possible, and treat its political or philosophical advice as roleplay rather than modern professional guidance.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
97% confidence
Finding
The trigger phrase "hobbes" is a single, common proper noun and is broad enough to cause accidental activation when a user merely mentions Hobbes rather than intending to invoke the skill. While this skill is otherwise constrained (no tools, model invocation disabled), unintended activation can still cause confusing routing, persona hijacking of a normal conversation, or denial of the user’s intended interaction.

Static analysis

No suspicious patterns detected.