ClawHub
Back to skill

Security audit

Content Calendar

Security checks across malware telemetry and agentic risk

Overview

This is a local content-planning skill that uses markdown files and has no evidence of hidden code, credential use, network transmission, or destructive behavior.

Install this if you want your agent to manage local content-planning files. Before use, decide whether to enable the optional HEARTBEAT.md recurring review, and avoid putting sensitive client, revenue, or unpublished strategy details in the content folder unless you are comfortable with your agent reading them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrases are broad enough that normal user requests about content planning could unintentionally activate the skill. In an agent environment, unintended activation can cause unsolicited reading or modification of workspace files like content/CALENDAR.md and related folders, creating automation side effects the user did not explicitly request.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The setup flow directs the agent to create files, folders, and recurring workflow hooks, but it does not prominently warn that local workspace contents will be created or modified. This can lead users to authorize the skill without realizing it will write to disk or update operational files such as HEARTBEAT.md, which is a meaningful safety and consent issue in agentic environments.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.