ClawHub
Back to skill

Security audit

Switching Costs

Security checks across malware telemetry and agentic risk

Overview

This is a plain Markdown business-strategy skill with no executable behavior; the only notable issue is broad activation wording around lock-in topics.

Installers should understand this skill may steer business discussions toward switching-cost and lock-in analysis. Use it for legitimate retention, competitive, investment, or market-structure analysis, and avoid using it to rationalize adversarial lock-in or customer-hostile product design.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The activation description uses broad phrases like asking why customers do not switch, how to build a moat, or mentioning general terms such as lock-in or stickiness, which can cause the skill to activate in many ordinary business discussions outside a tightly bounded use case. Over-broad routing is dangerous because it can steer the agent into providing specialized strategic guidance when a narrower, more appropriate skill or a safety/ethics layer should have handled the request first.

Vague Triggers

Low
Confidence
78% confidence
Finding
The 'When to Use' section contains vague invocation examples such as building a product with defensible switching costs or evaluating incumbent advantage, without crisp scope boundaries or a required problem frame. In practice, this increases the chance of accidental invocation on generic strategy conversations and can normalize advice on lock-in mechanics before the system determines whether the user's goal is ethical or appropriate.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.