ClawHub
Back to skill

Security audit

Finance Digital Avatar

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only finance avatar design guide with broad activation keywords but no code, data access, persistence, or hidden behavior.

Safe to install as a design-reference skill. Treat its regulatory and compliance notes as informational, verify official requirements before using outputs in real financial marketing or customer workflows, and consider narrowing or confirming activation when the user only mentions generic avatar or persona terms.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The Chinese trigger keywords are very broad, generic finance/avatar terms such as '数字人' and '品牌人设', which can cause the skill to activate for many ordinary user requests that are not actually asking to use this specific capability. In an agent system, ambiguous invocation scope can lead to inappropriate routing, unintended disclosure of skill behavior, or the application of this skill in contexts where another safer or more precise skill should have handled the request.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.