ClawHub
Back to skill

Security audit

AI Slides & Presentation

Security checks across malware telemetry and agentic risk

Overview

This skill coherently uses YouMind to generate slide decks, but users should understand that their presentation content is sent to YouMind and stored in a YouMind board.

Install only if you trust YouMind and its npm CLI. Avoid submitting confidential, regulated, or customer-sensitive presentation content unless you are comfortable sending it to YouMind and storing the resulting deck there. Configure the API key locally rather than pasting it into chat.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list includes generic terms such as 'presentation' and 'slides', which can match many ordinary requests and cause the skill to activate unexpectedly. Over-broad activation is risky because this skill can install software globally via npm and invoke external CLI/API actions, so accidental invocation may expose data or trigger unintended networked operations.

Vague Triggers

Low
Confidence
77% confidence
Finding
The description encourages invocation on broad language like 'create slides' and 'make presentation' without strong constraints, increasing the chance of unintended routing to this skill. In context this is less severe than executable prompt injection, but still matters because the skill performs external API calls and may install a CLI.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
88% confidence
Finding
The trigger 'create slides' overlaps with a common built-in verb pattern ('create'), which can shadow or hijack generic user requests that were not intended for this skill. Because activation can lead to package installation, API-key checks, and external content submission, command-shadowing meaningfully increases the chance of unintended side effects.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.