ClawHub
Back to skill

Security audit

AI Citation Content Writer

Security checks across malware telemetry and agentic risk

Overview

This is a local writing-template skill with documentation gaps, but no evidence of hidden access, credential use, persistence, or data theft.

Install only if you want a simple local template-writing aid. Use explicit safe output filenames in a project folder, do not rely on the documented batch or interactive commands unless the publisher adds them, and review generated content because several advertised formats are not actually implemented.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The activation text is very broad and overlaps with ordinary writing tasks, increasing the chance the skill will be invoked in situations the user did not specifically intend. Over-broad triggering can cause prompt hijacking of benign writing workflows, unexpected file generation, or insertion of this skill's optimization agenda into unrelated user requests.

Vague Triggers

Low
Confidence
87% confidence
Finding
The eval prompts are very broad content-writing requests and do not clearly constrain when the skill should activate versus when a general-purpose writing assistant should respond. This can cause over-triggering, where the skill is invoked for ordinary website copy requests, increasing the chance of unintended behavior, prompt-scope expansion, or misuse of the skill outside its intended AI-citation niche.

VirusTotal

46/46 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.