ClawHub
Back to skill

Security audit

Adaptive Reasoning

Security checks across malware telemetry and agentic risk

Overview

This is a low-risk instruction-only skill that automatically changes how much the agent thinks, but it does not access files, credentials, networks, or accounts.

Install this only if you want the agent to automatically spend more effort on complex requests and occasionally mark responses with reasoning icons. Avoid it if you prefer explicit control over reasoning mode, consistently fast responses, or unmodified response formatting.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

High
Confidence
95% confidence
Finding
The skill is explicitly configured to trigger on every user message, making it a globally applied behavioral override rather than a narrowly scoped helper. Broad automatic triggers increase the chance of unintended state changes, policy interference, or degraded response handling across unrelated conversations, especially because this skill modifies reasoning behavior before normal answering.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The automatic activation logic is underspecified and mixes multiple mechanisms (internal command, tool call, silent enablement) without firm authorization boundaries or conflict handling. That ambiguity can cause inconsistent behavior, unintended tool invocation attempts, or silent mode changes that are difficult to audit and may interfere with system-level controls.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to enable reasoning silently and only signal it with an icon or no notice at all, which reduces transparency around internal state changes. Silent behavioral changes can mislead users about how their request is being processed, complicate consent and debugging, and make it easier for adversarial prompt content to influence hidden processing modes without scrutiny.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.