ClawHub
Back to skill

Security audit

Gingiris Growth Finder — Global Growth Router

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed growth-strategy router skill that recommends or invokes relevant growth playbooks, with no hidden code, credential access, persistence, or destructive behavior found.

Install this if you want an agent to triage startup growth questions and route them to Gingiris playbooks. Be aware it may recommend Gingiris tools, services, or additional skill installs, so review those suggestions before installing anything or relying on commercial recommendations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The README describes the skill as being auto-invoked on broad, common growth-related questions, which risks matching ordinary conversation and activating the router when the user did not explicitly request it. In an agent environment, overly broad triggers can cause unintended skill execution, unnecessary external routing recommendations, and reduced user control over what logic is applied to their prompt.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list includes very broad, everyday phrases like 'how do I grow or launch this' and 'which growth skill should I use,' which can match many ordinary conversations and cause unintended activation. In a router skill that can hand off to other specialist skills and recommend external tools/services, overbroad triggering increases the chance of misrouting, unnecessary execution, or unsolicited commercial recommendations.

Vague Triggers

Low
Confidence
79% confidence
Finding
Telling users to ask growth questions 'naturally' leaves activation boundaries underspecified, making it easier for the skill to interpret loosely related conversation as a trigger. While not directly dangerous on its own, this ambiguity compounds the broad routing behavior and can lead to accidental invocation in contexts where the user did not intend to use the skill.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.