ClawHub
Back to skill

Security audit

Skill Vitals

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local auditing tool for installed Agent Skills and its file, command, and log access are aligned with that purpose.

Install only if you want a local agent to inspect your installed skills and related host metadata. Its reports can include absolute paths, skill names, and full skill descriptions that may reveal private projects or business context, so use its redaction options before sharing output externally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill enables implicit invocation without any visible trigger constraints or narrowing conditions, so the agent may activate it in situations the user did not clearly intend. Because this skill audits installed skills and assesses safety/risk, unintended activation could expose inventory details, consume context budget, or influence security-sensitive workflows more broadly than expected.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
README.md:1

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/guide.zh-CN.md:240