ClawHub
Back to skill

Security audit

Idiom Dictionary

Security checks across malware telemetry and agentic risk

Overview

This is a small offline idiom dictionary skill, but one bundled helper stores local command data and has a broken remove command users should not rely on for deletion.

Safe to install for offline idiom lookup. Avoid putting secrets or private notes into the generic helper commands, and do not rely on its remove command to delete stored entries; inspect or clear the configured local data directory manually if needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The `remove` command claims to delete an entry but does not alter the backing store at all; it only prints a success-like message and logs the request. This creates a deceptive state where users or downstream automation may believe sensitive or unwanted data was removed when it remains present in `data.log`, causing data retention, privacy, and workflow integrity issues.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.