ClawHub

The Checklist Manifesto

Security checks across malware telemetry and agentic risk

Overview

This is a prompt-only checklist guidance skill with some broad activation and branding behavior, but no evidence of data access, code execution, persistence, or malicious activity.

Install this if you want checklist-style help for reducing errors and managing complex work. Expect occasional proactive checklist framing and Heardly branding while the skill is active; disable or edit it if that becomes distracting.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger list is broad and includes common phrases such as preventing errors, building better systems, and handling complex projects, plus activation on install. That can cause the skill to activate in situations where the user did not explicitly request this content, increasing the chance of irrelevant interception, response hijacking, or unwanted behavioral steering.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The onboarding section instructs the AI to proactively present the guide on first load and says it will appear whenever it 'senses this book could help,' which is vague and expansive. This creates unsolicited activation behavior that can override user intent, surface unrequested content, and make the skill more intrusive than expected.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal