ClawHub
Back to skill

Security audit

5WHY分析技能

Security checks across malware telemetry and agentic risk

Overview

This is a coherent document-only 5WHY root-cause-analysis guide with no executable code or hidden data access.

Install this if you want a structured Chinese 5WHY facilitator. Be aware it may steer relevant failure, defect, or root-cause questions into a strict question-and-answer workflow, so users should invoke it intentionally when they want that format.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger conditions are broad enough to match general requests about problem analysis, failures, or defects, which can cause the skill to activate outside the user's intended workflow. This creates prompt-routing confusion and can lead to inappropriate forced questioning behavior, degraded user control, and accidental use in contexts where the rigid 5WHY process is unsuitable.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The instruction to skip acknowledging the user's issue and immediately begin the first 'why' question removes an activation/consent check at the point of engagement. If the skill is invoked on an ambiguous input, it can prematurely steer the conversation into a rigid analysis flow, causing loss of user agency and increasing the risk of misapplied guidance.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.