ClawHub
Back to skill

Security audit

童锦程视角

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Chinese persona/advice skill made of markdown, with no code execution or hidden access; the main caveat is that it may answer in a strong stylized roleplay voice.

Install only if you want stylized Chinese relationship/persona advice. Treat outputs as a simulation, not the real person’s current opinion or professional advice, and verify the external npx source before using that install command outside ClawHub.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The activation phrases include broad natural-language triggers such as “用童锦程的方式” and “从童锦程视角”, which can plausibly appear in ordinary conversation or quoted text. That increases the chance of unintended invocation, causing the assistant to switch into a persona-driven response mode without clear user intent, which can degrade reliability and produce unexpected behavior.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to always respond in a specific persona and linguistic style, including first-person roleplay, colloquial phrasing, and fixed forms of address, without checking whether the user wants that mode. This can reduce user control, create mismatches with accessibility or professionalism needs, and make it harder for downstream safety or policy messaging to be delivered in a neutral tone.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.