ClawHub
Back to skill

Security audit

Bayesian Reasoning

Security checks across malware telemetry and agentic risk

Overview

This is a plain educational Bayesian-reasoning skill with no executable code, credential handling, persistence, or hidden system-changing behavior.

Installers should expect this skill to guide probability reasoning and sometimes activate on broad Bayesian terms. There is no evidence of code execution or data access, but users may want tighter trigger wording if over-activation is annoying.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The manifest description says to activate when the user says terms including 'prior', 'posterior', and 'update my belief'. 'Prior' and especially 'update' phrasing can appear in ordinary conversation outside Bayesian reasoning, making the activation scope broader than the surrounding domain-specific examples suggest.

Vague Triggers

Low
Confidence
93% confidence
Finding
The list says the skill applies when someone says 'Bayesian,' 'prior,' 'posterior,' 'base rate,' 'likelihood ratio,' 'update'. The standalone word 'update' is too generic and overlaps heavily with normal speech, so it does not clearly distinguish Bayesian contexts from unrelated ones.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- "Evidence is consistent with X" is being treated as proof of X
- Base rates ignored — a rare event treated as probable because evidence "looks like" it
- Correlated evidence pieces treated as independent updates
- A benchmark score, AI-capability claim, AI-adoption stat, or AI-capex/valuation figure is being treated as proof without asking how often that signal appears when the underlying claim is false
- Someone says "Bayesian," "prior," "posterior," "base rate," "likelihood ratio," "update"

**Not when:** genuinely deterministic; no data to anchor a prior; cost of formal update exceeds the value of being more right.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.