ClawHub

botlearn-writer

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a straightforward article-writing helper, with only minor trigger-routing ambiguity to consider.

Before installing, understand that broad phrases like "write about" may route ordinary writing requests into this article-writing workflow. That is not a security blocker, but users who rely on precise skill routing may prefer narrower trigger wording.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger set is overly broad because terms like "compose" and "write about" can match a wide range of ordinary user requests, causing the skill to activate outside its intended scope. This increases the chance of unintended tool use and routing to this skill when a more narrowly scoped or safer behavior would be appropriate.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
82% confidence
Finding
The trigger phrase "write about" overlaps with the more general built-in command "write", which can cause the wrong skill or command path to activate. This creates ambiguity in command routing and could let this skill intercept requests intended for a trusted built-in capability, leading to unexpected behavior or policy bypass depending on what the skill does when invoked.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal