ClawHub
Back to skill

Security audit

Daily English Vocab

Security checks across malware telemetry and agentic risk

Overview

This skill sets up daily English lesson messages and keeps a small local progress file, which matches its stated learning purpose.

Install this only if you want recurring daily lesson messages. Confirm the cron schedule, timezone, channel, and recipient chat ID, and remove or disable the cron when you no longer want it. The skill also keeps a small local progress file so future lessons can rotate topics and avoid repeats.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to persist learner state in a local file without any user notice, consent, retention policy, or minimization guidance. Even though the stored fields seem low sensitivity, persistent storage can reveal usage patterns and learning history, and future edits may expand the stored data without safeguards.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.