ClawHub
Back to skill

Security audit

谛观·射覆 | Shefu

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed I Ching-style divination skill that runs local hexagram calculations, with broad activation phrases as the main caution.

Install this only if you want a divination-style assistant. Use clear wording because generic phrases may activate it unexpectedly, and treat outputs as entertainment or symbolic interpretation, not medical, legal, financial, safety, or other high-stakes advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

High
Confidence
96% confidence
Finding
The changelog explicitly states that any user response is treated as a signal to trigger divination, causing the agent to act without clear, informed user consent. In an interactive agent context, this weak trigger boundary can lead to unintended tool use, surprising behavior, and collection or processing of user input for a sensitive spiritual/personalized action the user did not explicitly request.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases include very broad everyday language such as generic requests to "start a divination" or "guess," which can cause the skill to activate during ordinary conversation unrelated to this skill. Overbroad activation is risky because it can unexpectedly hijack user interactions, collect context the user did not intend to send to the skill, or interfere with other skills and system behavior.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The open-ended invocation example encourages unconstrained guessing about arbitrary household items without defining clear activation boundaries or user intent confirmation. This makes accidental invocation and context overreach more likely, especially in multi-skill environments where free-form conversation may resemble the example and trigger the skill unexpectedly.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list contains multiple broad, everyday phrases such as '算一算', '预测', and '猜一猜' that are likely to appear in ordinary conversation, increasing the chance of unintended skill activation. In a divination-oriented skill, accidental invocation can cause prompt hijacking of user intent, confusing responses, or inappropriate routing away from the user's actual request.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.