ClawHub
Back to skill

Security audit

repo

Security checks across malware telemetry and agentic risk

Overview

This skill is a repository documentation helper that reads common project config files and generates a CONTRIBUTING.md file, with no evidence of hidden or destructive behavior.

Before installing, be aware that generic requests like project initialization or contributing guide generation may invoke this skill, and review the generated CONTRIBUTING.md before accepting it, especially if you need a specific language or wording policy.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger list includes very broad phrases such as "init", "project init", and "initialize project", which can match common user requests and cause the skill to activate unexpectedly. In an agent environment, overbroad activation can redirect unrelated tasks into repository-scaffolding behavior, increasing the chance of unintended file generation or workflow interference.

Natural-Language Policy Violations

Medium
Confidence
80% confidence
Finding
The skill states it should choose language automatically ("English for open source, Korean for internal") without explicit user opt-in. While not directly a code-execution issue, this can override user intent or organizational policy and produce outputs in an unintended language, which may cause misunderstanding in contribution guidelines or compliance-related documentation.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrases are broad enough to match common user requests like 'contributing guide' or 'initialize project' without clearly constraining scope to safe, explicit generation of CONTRIBUTING.md. In an agent environment, ambiguous activation can cause the skill to run unexpectedly, inspect repository files, and write or overwrite documentation when the user intended something else.

Natural-Language Policy Violations

Medium
Confidence
78% confidence
Finding
Forcing output language to match the project rather than the user's request reduces user control and can cause the agent to ignore explicit user preferences. While not directly enabling code execution or data exfiltration, it is a policy/scope violation that can lead to misleading or undesired output behavior in multi-language repositories.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.