ClawHub

Duel Loop

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed QA drafting and review workflow with file-writing behavior that matches its purpose and no hidden executable code or credential handling found.

Install this if you want an automated draft-and-QA loop. Before using it on important repositories or documents, make sure the task explicitly names the QA workflow, confirm where drafts and final content will be written, and review the final diff before accepting production-file changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list includes generic terms such as '审核', '评审', and 'review', making accidental invocation plausible during normal conversation. Because this skill initiates a multi-agent drafting/review workflow and can lead to file creation and eventual production-file updates, unintended activation can cause the system to perform actions the user did not clearly request.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs writing outputs to draft files and then 'landing' approved content into production files, but it does not require an upfront user warning or explicit confirmation before modifying files. In an agentic environment, this creates a meaningful integrity risk: the skill may alter workspace or production artifacts based on an ambiguous request or an accidentally triggered QA flow.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal