ClawHub
Back to skill

Security audit

智能代码助手

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward code-assistance skill with broad coding prompts but no sensitive access, persistence, installation scripts, or hidden side effects.

Reasonable to install for code review, explanations, refactoring suggestions, and documentation help. Because it may activate on broad coding prompts, confirm when it is being used and avoid providing secrets or highly sensitive proprietary code unless that is acceptable in your agent environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill advertises very generic trigger phrases such as asking to explain code, find problems, optimize code, or generate documentation. Because these overlap with ordinary user requests, the skill may activate too broadly, causing unintended routing or interception of common coding tasks and reducing user control over which capability is invoked.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.