ClawHub
Back to skill

Security audit

article-idea-capture

Security checks across malware telemetry and agentic risk

Overview

This skill is an idea-capture helper, but it can automatically save user writing ideas to a fixed Feishu document or local file with broad triggers and no confirmation step.

Install only if you intentionally want selected article ideas saved into the named Feishu idea pool or the listed local fallback file. Use explicit save commands, avoid sharing sensitive drafts unless you are comfortable with that storage location, and review the document or local file periodically for unwanted entries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The invocation criteria are very broad and include common conversational phrases like having an idea, topic, inspiration, or wanting to save a thought. This can cause unintended auto-invocation during ordinary chat, leading the agent to capture and persist user content without sufficiently explicit user intent, which is a security and privacy risk when combined with downstream write actions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to write user-provided content to a fixed local workspace path as a fallback, but it does not require explicit user consent or prominently warn that content may be stored locally. This creates a privacy and data-governance risk because sensitive brainstorming content could be persisted on disk unexpectedly, especially if the user believes storage will occur only in Feishu.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.