ClawHub
Back to skill

Security audit

Generate conventional commit messages from code changes or diff.

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only helper for drafting Conventional Commit messages, with no executable code or hidden access.

Installers should treat this as a drafting aid. Review any diff before sharing it because diffs can contain secrets, and only allow clipboard actions or an actual git commit after explicitly choosing the message yourself.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list is broad enough to match ordinary requests about writing commit text, which can cause the skill to activate in situations the user may not intend. While this is not directly code-executing, overbroad activation increases the chance of prompt shadowing, unwanted interception of user intent, or misrouting away from safer built-in behavior.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.