ClawHub
Back to skill

Security audit

My MBTI

Security checks across malware telemetry and agentic risk

Overview

This appears to be a low-impact MBTI style-switching skill with somewhat ambiguous shortcuts, but no evidence of harmful system access or data handling.

Install only if you want MBTI/persona-style switching. Be aware that short type labels or combinations may accidentally change the assistant's style in conversations about MBTI; avoid relying on this skill for high-stakes work unless you explicitly control when it is active.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill treats bare MBTI tokens like "INTJ" or "ENFP" as immediate control commands, which creates an ambiguous command surface that can be triggered by ordinary user text rather than explicit intent. In practice this can cause unintended persona switching, making the assistant mis-handle user requests or be steered by quoted/example text instead of actual commands.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The preset-combination rule says direct input like "ISFJ+ISTJ" should be interpreted as a style command, but it does not define boundaries between command mode and normal discussion. That ambiguity enables accidental or prompt-injected mode changes whenever these strings appear in examples, copied text, or analytical discussion.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.