ClawHub

The Brain That Changes Itself: Stories of Personal Triumph from the Frontiers of Brain Science

Security checks across malware telemetry and agentic risk

Overview

This is an educational neuroplasticity book-summary skill with overly broad activation terms, but it does not request tools, data access, persistence, or executable authority.

Install this as an educational book companion, not as a medical or mental-health treatment tool. Be aware it may activate on broad words unrelated to the book, and verify any stroke, OCD, chronic pain, or rehabilitation suggestions with qualified clinicians before acting on them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

High
Confidence
96% confidence
Finding
The trigger list includes extremely common words like "brain," "change," "pain," "learning," "memory," and "focus," which can cause the skill to activate during ordinary conversations far outside its intended scope. Overbroad activation increases the chance of unsolicited medical-style guidance being injected into unrelated contexts, which is especially risky because this skill discusses health, recovery, OCD, pain, and rehabilitation.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The description combines precise triggers with an open-ended "or mention" clause that effectively turns many everyday health, cognition, and therapy terms into activation signals. This ambiguity makes the routing behavior unpredictable and broadens the attack surface for prompt hijacking, accidental invocation, or irrelevant medical-adjacent responses.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal