ClawHub
Back to skill

Security audit

智囊团：私董会

Security checks across malware telemetry and agentic risk

Overview

This is a prompt-only Chinese decision-analysis skill with some usability and invocation-scope caveats, but no evidence of hidden system access, credential handling, persistence, or destructive behavior.

Install this as an advisory reasoning template, not as an authority for factual or regulated decisions. Expect Chinese-first behavior, verify that you are invoking the intended skill despite the "expert-thinking" naming mismatch in examples, and fact-check outputs before using them for high-stakes business, legal, medical, financial, or policy decisions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The description triggers on very broad situations such as complex problems, strategic decisions, study planning, research analysis, and management issues, which can match a large share of ordinary user requests. This increases the chance of inappropriate auto-selection or over-invocation of the skill, causing prompt hijacking of benign workflows, reduced user control, and unnecessary exposure of user context to a complex multi-agent process.

Natural-Language Policy Violations

Medium
Confidence
79% confidence
Finding
The metadata presents the skill name and description only in Chinese without indicating that output language should follow user preference or locale. In a general-purpose environment, this can force unexpected language switching, degrade transparency around what the skill does, and make it harder for users or reviewers to recognize unsafe behavior or unintended activation.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The activation and default prompt are very broad, encouraging use for 'complex problems' without clear boundaries, approval gates, or domain restrictions. This can cause the skill to be invoked in inappropriate or high-risk contexts where multi-expert framing may generate overconfident strategic, legal, financial, or medical-style guidance without sufficient safeguards.

Natural-Language Policy Violations

Medium
Confidence
80% confidence
Finding
The skill metadata and prompt are written to drive Chinese-language interaction by default, without indicating language negotiation based on user preference. This can reduce user comprehension, transparency, and consent, especially if the user expects another language, increasing the chance of misunderstanding important advice or decisions.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.