ClawHub
Back to skill

Security audit

Zentao Work Stats

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed, read-only Zentao reporting helper, but users should treat the generated employee work reports as sensitive data.

Install only if you have authorized read-only access to the Zentao database and a legitimate reason to analyze the named user's work data. Keep config.json and generated reports private, use a read-only database account, and avoid sharing reports through insecure channels.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The natural-language content throughout the skill file is exclusively Chinese, including the description, activation conditions, safety warnings, and operating instructions. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not documented here.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The template title and instructions are written entirely in Chinese and direct the generated report to follow that structure, which implies a fixed output language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified or optional.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.