ClawHub
Back to skill

Security audit

Editorial Chief Workflow

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed editorial workflow skill that stages review-ready content in Obsidian, with a local file-write caution but no hidden or malicious behavior.

Install only if you want an agent to help prepare real publication files in your Obsidian workflow. Before use, confirm the exact vault path, target folder, filenames, and whether existing files may be overwritten; treat publishing as a separate manual approval step.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly directs delivery of outputs into the real Obsidian publication directory, but it does not require a clear user confirmation or warn that this can modify real user files outside a sandbox. In an agentic workflow, this creates a meaningful risk of unintended writes, overwrites, or placement of publication-ready content into sensitive or live directories.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The instructions to resolve the real Obsidian vault path and stage a reviewable file in the target directory operationalize direct interaction with user storage, yet they omit safeguards such as path confirmation, write-scope limitation, backup behavior, or explicit consent. This increases the chance of writing to the wrong vault, overwriting existing notes, or placing unreviewed assets into a live publication workflow.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.