ClawHub
Back to skill

Security audit

competitor-analysis

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only SEO/GEO competitor analysis skill with some broad trigger wording and disclosed credentialed integrations, but no evidence of hidden execution or data theft.

Install this if you want SEO/GEO competitor research help. Before using SKILLBOSS_API_KEY or connecting analytics, Search Console, SEO tools, or AI-monitoring tools, confirm the credential scope and prefer least-privilege access or the manual-data workflow for sensitive business metrics.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The description embeds highly generic activation phrases such as "analyze competitors," "competitive analysis," and "who ranks for," which plausibly match ordinary user requests outside the author's intended scope. In agent systems that auto-select skills from metadata, this can cause unintended invocation, leading the agent to apply this skill in contexts where competitor intelligence, external data gathering, or SEO-specific workflows were not explicitly requested.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger list contains multiple ambiguous phrases like "who ranks for," "competitive analysis," and "what are my competitors doing" that are broad enough to overlap with normal business, sales, product, or market research conversations. Because these are explicit manifest triggers, they increase the likelihood of accidental skill routing and may prompt collection or synthesis of competitor intelligence when the user did not intend an SEO/GEO analysis workflow.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.