ClawHub

Dkey Switch

Security checks across malware telemetry and agentic risk

Overview

This looks like a Windows window-switching skill, but it needs review because its main automation files are missing and one included launcher bypasses PowerShell execution policy.

Install only if you trust the publisher and can verify a complete release that includes the actual Windows scripts. Expect the skill to enumerate window titles and switch focus/tabs on your desktop; avoid using it while sensitive windows or active text fields are open, and prefer explicit confirmation before ambiguous matches.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The skill hard-codes Chinese as the agent identity/output language without indicating that it should adapt to the user's preferred language. This can cause unsafe or unusable interactions when users do not understand Chinese, increasing the chance that they misunderstand automation instructions or execute the wrong steps.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script invokes PowerShell with `-ExecutionPolicy Bypass`, which deliberately disables PowerShell's policy protections for the launched script. While execution policy is not a strong security boundary, bypassing it without disclosure or necessity reduces defense-in-depth and makes it easier for a tampered or replaced `d-switch.ps1` to execute in restricted environments.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal