ClawHub
Back to skill

Security audit

Training Quiz

Security checks across malware telemetry and agentic risk

Overview

This is a transparent retail training quiz skill, but installers should manage how employee quiz results are stored and shared.

Before installing, decide who may start tracked quiz sessions, who may request manager reports, what staff notice or consent is required, and how long quiz history should be retained. Narrowing trigger phrases and requiring confirmation before saving results would reduce accidental tracking.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger set includes very common phrases such as '测试', '训练', '练习', and 'training', which can match ordinary conversation and invoke the skill unintentionally. In this context, unintended activation is more concerning because the skill tracks employee performance and may start collecting or surfacing staff data without clear user intent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill states that it stores per-employee progress and can report results to managers, but it does not provide any notice, consent flow, retention policy, or access control guidance. In an employment setting, silent collection and disclosure of performance data can create privacy, compliance, and workplace monitoring risks, especially if users do not realize their quiz results are being persisted and shared.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.