ClawHub
Back to skill

Security audit

Opmc Creative Bureau

Security checks across malware telemetry and agentic risk

Overview

This is a structured product-planning skill that creates local project deliverables and a zip package, with no evidence of hidden or malicious behavior.

Install only if you want a comprehensive, multi-stage product incubation workflow. Expect it to create project Markdown files and a zip package; review the bundle before sending it anywhere, especially if it includes business plans, IP strategy, deployment details, or other sensitive material.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation condition is overly broad: it triggers not only on explicit invocation of the skill name, but also on common scenarios like 'creative projects from 0 to 1', MVP design, or startup incubation. That can cause the agent to activate this workflow for many ordinary product or strategy requests, increasing the chance of unwanted instruction takeover, excessive scope expansion, and generation of detailed technical deliverables the user did not explicitly request.

Missing User Warnings

Low
Confidence
76% confidence
Finding
The skill instructs the agent to package all deliverables into a zip bundle without any user-facing confirmation or data-handling warning. In a workflow that may include business strategy, IP materials, technical specs, and deployment details, bundling files can increase accidental over-collection, retention, or disclosure of sensitive project information.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.