ClawHub
Back to skill

Security audit

企业触达路径挖掘

Security checks across malware telemetry and agentic risk

Overview

This skill helps plan lawful business outreach using public company information, with clear limits against private data collection or deceptive contact tactics.

Install only if you want public-source enterprise outreach or招商 preparation. Keep use limited to official/public organizational channels and do not ask it to find private phone numbers, personal accounts, non-public relationships, impersonation angles, or pressure-based outreach tactics.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
85% confidence
Finding
The activation description is broad enough to match many ordinary enterprise research, contact lookup, or business-preparation requests, which can cause the skill to activate outside its intended scope. In this context, over-activation is risky because the skill is designed to produce detailed contact-path and outreach strategies, potentially steering normal research tasks into sensitive influence or targeting workflows.

Vague Triggers

Medium
Confidence
89% confidence
Finding
Several trigger phrases are generic business terms like analyzing related institutions, planning visits, or preparing outreach, so the skill may activate on routine business-assistance prompts that do not require this high-touch contact-mining behavior. Because the skill outputs structured pathways to reach organizations and key roles, accidental activation increases the chance of unnecessary collection, profiling, or persuasive outreach guidance in situations where a simpler, less sensitive skill would suffice.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.