ClawHub
Back to skill

Security audit

Pans Contract Generator

Security checks across malware telemetry and agentic risk

Overview

This is a local GPU lease contract draft generator with no hidden network, credential, or background behavior found.

Install this only if you want a Chinese-language GPU or AI compute lease draft generator. Treat the generated contract as a starting template, review it with qualified legal counsel before use, and choose the --output path carefully because the script writes to the path you provide.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger phrases are broad and generic, including terms like '合同生成', '销售合同', and 'contract generator', which can cause the skill to activate in conversations where the user did not intend to invoke this specific contract-writing tool. Unintended activation can lead to context hijacking, inappropriate drafting actions, or accidental handling of sensitive commercial terms in the wrong workflow.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The description states the skill in Chinese and frames behavior around Chinese-language contract generation without indicating language negotiation or user preference handling. This can cause the skill to respond in an unexpected language, increasing the chance of misunderstanding legal or commercial terms and degrading safe, user-aligned operation.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.