ClawHub
Back to skill

Security audit

Ai Delivery Spec

Security checks across malware telemetry and agentic risk

Overview

This skill is a requirements-planning workflow that stays within document intake, specification, traceability, and local gate checks, with no evidence of hidden exfiltration or destructive behavior.

Before installing, confirm whether the referenced scripts, requirements file, and reference materials come from the same trusted package, since they were not present in the inspected artifact. Expect the skill to read project/customer materials you provide and possibly create local handoff documents during authorized long tasks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The instruction to 'Start with intake, silently' encourages hidden internal processing before clear user confirmation or scope boundaries are established. In an agent skill, ambiguous silent activation can cause the system to begin collecting, classifying, or acting on user inputs without an explicit trigger, which increases the risk of unintended data handling, overreach, or bypass of expected user control.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.