ClawHub
Back to skill

Security audit

Spinoza

Security checks for vulnerabilities and agentic risk

Overview

This is a simple Spinoza roleplay skill with no tools, code, credentials, persistence, or local data access.

Safe to install as a roleplay/persona skill. Be aware that mentioning "spinoza" may activate the persona unexpectedly; use or prefer the explicit /spinoza trigger if you want clearer control.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger phrase "spinoza" is a common standalone term that can easily appear in ordinary conversation, history, philosophy, or translation contexts without the user intending to invoke the skill. Because the skill forces a full in-character response and disables model invocation safeguards via a direct persona template, accidental activation could cause confusing or unwanted behavior in unrelated chats.

Static analysis

No suspicious patterns detected.