ClawHub
Back to skill

Security audit

image

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent marketing-image helper with expected guidance for image generation, screenshots, design tools, and optimization, and it does not show hidden or unsafe behavior.

Before installing, be aware that the skill may lead an agent to use your product screenshots, brand assets, and optional image-generation provider APIs. Review any assets before uploading them to third-party services, and avoid sharing API keys or private product context unless needed for the task.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The manifest description says to use the skill whenever the user wants to create, generate, edit, or optimize images, then adds many broad phrases such as 'generate an image' and 'create a graphic.' These triggers overlap with common user requests and do not provide exclusion examples beyond a couple adjacent skills, which could cause unintended invocation for non-marketing or non-specialized image tasks.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
3. **Add context** — callout arrows, feature labels, before/after comparisons
4. **Annotate with code** — Hyperframes or HTML/CSS for programmatic overlays

**Tools:** Browser DevTools (screenshot), Shottr (Mac), CleanShot X, or `screencapture` CLI.

### Profile & Listing Banners
Confidence
85% confidence
Finding
Tools:*

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.