ClawHub
Back to skill

Security audit

Daily Shortdrama Report

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only daily reporting skill that reads scoped project notes and session usage to generate a short-drama work report.

Install this if you want daily short-drama team reports that may include token usage and entries from the named memory files. Keep those memory files limited to information suitable for reports, and invoke the skill explicitly because generic phrases like daily report or summary may trigger it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill declares broad trigger phrases such as “日报/工作日报/每日总结/每日报告”, which are common natural-language requests and can easily match unrelated user intents. This can cause accidental invocation of the skill, leading it to read session usage and local memory files in contexts where the user did not clearly request this specific reporting workflow.

Vague Triggers

Medium
Confidence
97% confidence
Finding
The dedicated trigger list repeats ambiguous, high-frequency phrases without contextual constraints, increasing the chance of unintentional skill activation during ordinary conversation. In this skill, accidental activation is more concerning because the instructions direct the agent to access session_status and read memory files for today/yesterday and targets, which expands data exposure beyond the user’s immediate prompt.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.