ClawHub
Back to skill

Security audit

Tdd

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only TDD workflow skill that may be overly eager when triggered, but its behavior is disclosed and aligned with testing and bug-fixing work.

Install this if you want an assertive TDD workflow that pushes the agent to write and run tests before implementation. Be aware that broad trigger phrases like "verify" or "doesn't work" may invoke it during ordinary debugging, so review whether that workflow fits how you want your agent to behave.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
97% confidence
Finding
The trigger list contains broad, everyday phrases such as "doesn't work," "not working," and "verify," which can match many normal user requests outside an explicit TDD context. This can cause unintended invocation of the skill and force its rigid workflow, increasing the chance of inappropriate tool use or disruptive behavior in unrelated tasks.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.