ClawHub
Back to skill

Security audit

亲笔写的

Security checks across malware telemetry and agentic risk

Overview

This is a low technical-risk writing skill, but it is explicitly built to hide AI authorship from readers or workplace reviewers.

Install only if you will use it for permitted editing, clarity, and style adaptation. Do not use it to conceal AI assistance where a school, employer, client, publication, or platform requires disclosure or truthful authorship representation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README explicitly markets the skill as making AI-written Chinese text look human-written and says it helps ensure leaders cannot tell it was AI-generated. That materially enables deception, ghostwriting concealment, and evasion of authenticity or disclosure expectations, and the absence of any warning or policy guardrails increases misuse risk.

Natural-Language Policy Violations

High
Confidence
99% confidence
Finding
The skill’s stated purpose is to make AI-generated Chinese writing look human-authored and specifically avoid detection, which directly enables deception and provenance evasion. This is dangerous because it can be used to misrepresent authorship in academic, workplace, media, and platform contexts, undermining trust and potentially facilitating fraud or policy evasion.

Ssd 2

Medium
Confidence
99% confidence
Finding
The skill is explicitly designed to rewrite text so it appears human-authored and avoids AI detection, which is a classic stealth/deception capability rather than ordinary copyediting. In context, the line '让领导看不出是AI写的' increases risk because it targets real-world concealment from decision-makers, not just improving readability.

Ssd 4

Medium
Confidence
97% confidence
Finding
The workflow systematically identifies 'AI traces,' asks for the publication target, and then rewrites the content according to platform-specific rules to remove those traces before release. That step-by-step operational guidance makes the skill more dangerous than a generic style editor because it actively trains and assists users in evading AI-authorship detection across multiple channels.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.