ClawHub
Back to skill

Security audit

Decision Distiller

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent decision-record helper; its file-writing behavior is limited to creating local decision notes and is disclosed by its purpose.

Install only if you want local decision records stored by the skill. Be aware the helper script can create markdown files in its default data folder or any directory you set with DECISION_DATA_DIR; review that location before using it for sensitive personal or business decisions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
Lines L023-L025 present one usage scenario entirely in Chinese and prescribe the expected output in Chinese, while the rest of the skill is written in English. This creates an implicit language-specific behavior without any user opt-in or documented locale constraint, which can violate language/locale policy expectations.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.