ClawHub
Back to skill

Security audit

Xianyu Team Optimizer

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a roster or team grouping helper, with the main concern being broad trigger wording rather than hidden or harmful behavior.

Install only if you want an assistant to help organize game or guild team rosters. Avoid pasting unrelated private chat logs, and invoke the skill explicitly when you intend it to process group or roster information.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger conditions are broad and include generic phrases like '怎么分组' or '帮我排一下队' when combined with loosely related guild/teaming context, which can cause the skill to activate on unintended conversations. Over-broad activation can lead to incorrect tool use, unnecessary parsing of pasted chat rosters, and privacy exposure if unrelated user content is processed as input.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal