ClawHub
Back to skill

Security audit

实验设计技能

Security checks across malware telemetry and agentic risk

Overview

This skill is a local experiment-plan CSV generator with no hidden access, but users should validate its advanced design claims before relying on it.

This appears safe to install from a security perspective for generating local CSV experiment plans. Before using it for lab, manufacturing, or costly decisions, verify fractional-factorial, orthogonal, and Taguchi designs with a trusted DOE/statistics tool or expert, because the implementation is simplified and may not provide the advertised design properties.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill metadata and user-facing claims state support for DOE methods such as orthogonal experiments and Taguchi methods, but the implementation only generates full factorial and a simplified 2-level fractional factorial design. In an experiment-design skill, this mismatch can mislead users into running statistically inappropriate studies, producing invalid conclusions, wasted lab/manufacturing effort, or unsafe process decisions based on incorrect designs.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The comments and docstrings describe standard generator-based fractional factorial support, but the code actually uses a simplified XOR-derived scheme and does not meaningfully use the declared generator table. In this skill context, that is dangerous because users may trust the output as a valid resolution III/IV/V design when aliasing structure and design properties may be wrong, leading to flawed experimental interpretation.

Vague Triggers

Medium
Confidence
75% confidence
Finding
The trigger conditions are broad enough that the skill may activate in contexts that only loosely mention DOE, experimental design, or orthogonal experiments. Over-broad activation can cause the agent to invoke this skill when a user wanted conceptual advice rather than file generation, increasing the chance of inappropriate tool use or confusing outputs, though the domain is low-risk and no sensitive capability is exposed here.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.