ClawHub
Back to skill

Security audit

product-marketing

Security checks across malware telemetry and agentic risk

Overview

This skill creates and updates a local product marketing context document, with repo reading and file writes that fit its stated purpose.

Install this if you want marketing skills to share a local product context file. Be aware it may read project documentation and marketing files when auto-drafting, and review the generated `.agents/product-marketing.md` before relying on it across other marketing tasks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill description contains many broad activation phrases such as 'positioning,' 'describe my product,' and 'who is my target audience,' which can match routine marketing discussion rather than an explicit request to run this skill. That increases the chance of unintended invocation, causing the agent to read repository files and create or modify shared context documents without sufficiently specific user intent.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The eval expects the skill to trigger on very casual phrasing like 'create a product context doc for my app,' which can cause the product-marketing skill to activate for broad, ambiguous requests. In a routing or agent-selection system, overly broad triggers increase the chance of misclassification, unintended file creation or modification, and interference with more appropriate skills.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.