ClawHub
Back to skill

Security audit

易经起卦

Security checks across malware telemetry and agentic risk

Overview

This is a coherent I Ching divination skill that runs a local hexagram script and may use web search for interpretation, with no evidence of hidden access, persistence, or destructive behavior.

Install only if you want an I Ching divination workflow that can run its included Python script and perform web searches using your question or resulting hexagram terms. Avoid putting sensitive personal details in divination questions, and treat the reading as interpretive reference rather than factual or professional advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The README says users can 'simply ask questions in natural language,' which frames activation far too broadly for a specialized divination skill. In agent environments that route requests based on vague descriptions, this can cause accidental invocation on unrelated prompts, unnecessarily executing local scripts and network lookups on user input not intended for divination.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The usage section instructs operators to load the project and then 'directly use natural language to ask questions,' again implying unrestricted activation. Because this skill runs a local script and performs online research, overbroad routing increases the chance of unintended tool execution, privacy leakage of arbitrary user prompts to external search, and interference with normal agent behavior.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The English section repeats the same broad activation model, making the issue accessible to a wider audience and increasing the likelihood of misrouting in multilingual deployments. In a tool-using agent, such ambiguity is operationally risky because it can cause this specialized skill to capture generic queries and trigger unnecessary local execution and external retrieval.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.