ClawHub
Back to skill

Security audit

competitors

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed marketing-writing guide for competitor comparison pages and does not contain executable code, hidden data handling, or privileged behavior.

Before installing, expect this skill to guide agents toward persuasive competitor comparison content and to use any local product-marketing context files you have provided. Review factual claims, pricing, and competitor descriptions carefully before publishing, especially for legal/compliance-sensitive comparisons.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger description is excessively broad because it activates for virtually any request involving competitor positioning, including sales, SEO, battle cards, teardowns, alternatives, and generic comparison intent. Overbroad routing can cause the wrong skill to be invoked, leading the agent to pull in persuasive or comparative workflows in contexts where neutral analysis, compliance review, or another specialized skill would be safer and more appropriate.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The eval explicitly expects the skill to trigger on 'casual phrasing' for a singular competitor-alternative request, but it does not define clear boundaries for what phrasing should qualify. In a routing or invocation system, this can encourage over-broad matching so the competitors skill is selected for loosely related prompts, causing misrouting, unintended competitive content generation, or reduced reliability of safer/more appropriate skills.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.