ClawHub
Back to skill

Security audit

List Responsiveness Comparer 1.0.0

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Chinese procurement checklist comparison assistant with no executable code, persistence, credential handling, or hidden data flows found.

Install this if you work with Chinese tender/procurement response lists and are comfortable with the declared MCP/knowledge-base lookup behavior. Treat its reports as comparison aids only; the skill itself correctly says final legal or procurement decisions remain with the proper review body.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Confidence
86% confidence
Finding
The entire README is written only in Chinese and does not indicate that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The entire skill specification is written as a mandatory Chinese interaction pattern, including required prompts and report formats, but it does not state that the user may choose another language. Under the policy, a skill that forces a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Medium
Confidence
98% confidence
Finding
All user-facing fields in the manifest, including the display name, description, knowledge-base names, and feedback channel text, are presented only in Chinese. This imposes a single language on users without offering any language choice or documenting a justified region-specific constraint.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.