ClawHub

Skill Creator

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only skill for creating and improving OpenClaw skills, with no hidden execution or data-access behavior found.

Install this if you want help authoring OpenClaw skills. Review generated skill edits before keeping them, especially persistent workspace skills, and avoid passing secrets or unrelated private workspace context into generated sub-agent prompts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill description is extremely broad and overlaps with ordinary editing, reviewing, and document-creation requests. Because skill descriptions are a primary auto-trigger mechanism, this can cause the skill to activate in unrelated contexts and inject powerful instructions about creating or modifying skills, increasing prompt-scope confusion and the chance of unintended self-referential behavior.

Natural-Language Policy Violations

Medium
Confidence
86% confidence
Finding
The language policy hard-codes English-only SKILL.md bodies without any user opt-in or context-sensitive exception. In a system serving multilingual users, this can override user intent, distort requested outputs, and create instruction conflicts where the skill imposes its own policy over the user's requirements.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal