Skill Finder Cn

• Outcome: Pass
• Latest audit: May 28, 2026, 12:49 PM
• Version:
  1.0.1

Overview

This skill is a straightforward ClawHub skill search and installation helper, with the main risk being that installing recommended skills changes the user's OpenClaw environment.

Use it for ClawHub skill discovery, but inspect any recommended skill before installing it. Only approve `clawhub install` for a specific skill you trust, because installed skills remain available to your OpenClaw agent after the current task.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases are broad enough to match common user requests about finding tools or getting help, which can cause the skill to activate outside its intended niche. In a skill that can search for and install other skills, overbroad activation increases the chance of unintended execution paths and exposure to unreviewed third-party content.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The usage examples define activation through open-ended natural-language requests without requiring explicit mention of ClawHub or skill installation, making invocation ambiguous. Because this skill recommends and installs external skills, ambiguous activation can lead to accidental tool use and a wider attack surface via discovery of potentially unsafe third-party skills.

VirusTotal

64/64 vendors flagged this skill as clean.