ClawHub

paper-cluster-survey-v2-2

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: it reads supplied paper files or URLs, extracts metadata, and helps draft a survey, with some normal but review-worthy network and local-tool behavior.

Install if you are comfortable with a literature-review helper that can read the PDFs or paths you provide, fetch paper URLs you provide, run local PDF extraction utilities, and write output files you request. Avoid giving it confidential documents or localhost/private-network URLs unless you intentionally want those processed, and review important extracted claims against the original papers.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill enables implicit invocation without any visible trigger constraints, exclusions, or narrowing conditions. Because this skill can ingest local PDFs and external URLs and then produce synthesized outputs, broad automatic invocation increases the chance it will activate in unintended contexts, causing unreviewed access to user-provided documents or network resources and expanding the attack surface for prompt-injection or data-handling issues.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script fetches arbitrary user-supplied URLs and follows redirects without validating destination hosts or private/internal IP ranges. In an agent or server environment, this creates SSRF-style risk: an attacker can cause outbound requests to internal services, cloud metadata endpoints, or other sensitive network locations under the guise of paper extraction.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal