ClawHub

daily-trending

Security checks across malware telemetry and agentic risk

Overview

This skill only fetches public trending-topic pages from TopHub and formats a short news summary, with no install-time code, credentials, persistence, or local access.

Install if you want a convenience summary of Chinese-platform trending topics. Be aware it contacts tophub.today when invoked and the skill intentionally omits source labels in the final output, so verify important news from primary sources.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger examples are broad enough that ordinary queries about '热榜' or current hot topics could invoke the skill unexpectedly, causing the agent to fetch and summarize external content when the user may not have intended that specific workflow. In a skill that performs network access and applies editorial filtering, unintended invocation can lead to surprising behavior, privacy expectation issues, or irrelevant external requests.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The skill explicitly instructs the agent to retrieve data from an external website, but it does not disclose that outbound network access will occur or that third-party content will be used. While the fetched source is fixed rather than user-controlled, the main risk is lack of transparency and trust: users may not expect an external request or the associated exposure of request metadata and reliance on unverified third-party content.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal