ClawHub
Back to skill

Security audit

Deep Research

Security checks across malware telemetry and agentic risk

Overview

This is a web research skill whose network searches, source fetching, citations, and optional report writing fit its stated purpose.

Install this if you want an agent to perform cited web research with Firecrawl or Exa. Be aware that broad prompts like research or investigate may activate it, and that configured research providers may receive your search queries and fetched URLs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill metadata includes very broad trigger phrases such as "research," "deep dive," and "investigate," which are common in many benign user requests. This can cause the skill to activate unintentionally and override more appropriate, narrower skills, increasing the chance of unnecessary web access, expanded data exposure, or unexpected behavior.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The activation criteria are open-ended and apply to a wide range of requests, including generic prompts like asking about the "current state of" a topic. In a skill that performs web search and fetching, broad activation increases the risk of unnecessary tool use, unintended retrieval of external content, and misrouting of tasks that should remain local or use safer specialized skills.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.