ClawHub
Back to skill

Security audit

Lanxin App Card

Security checks across malware telemetry and agentic risk

Overview

This appears to be a Lanxin card JSON helper; its broad trigger words may cause accidental activation, but the supplied evidence does not show harmful access or hidden behavior.

Install only if you specifically want a helper that outputs Lanxin application-card JSON. Be aware that generic Chinese trigger words may make it activate in ordinary card-related conversations, so review or narrow the trigger conditions if your environment supports that.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list contains broad, generic phrases such as '卡片' and related common terms that can match ordinary user conversation, causing unintended invocation of this skill. In context, the skill then forces a JSON-only response, which could suppress normal assistant behavior and mis-handle unrelated requests, making accidental activation more disruptive.

Overly Broad Trigger

Low
Category
Trigger Abuse
Confidence
91% confidence
Finding
The trigger '蓝信' is extremely short and likely to appear in ordinary discussion about the platform, making unintended invocation plausible. Because the skill contains strong instructions to output only raw JSON and avoid normal explanatory text, accidental activation can produce confusing or policy-bypassing behavior in unrelated contexts.

Overly Broad Trigger

Low
Category
Trigger Abuse
Confidence
97% confidence
Finding
The trigger '卡片' is overly generic and can match many benign conversations unrelated to Lanxin app cards. In this skill, accidental activation is more dangerous because the prompt aggressively constrains output to raw JSON only, which can derail normal assistant interactions and increase prompt-injection-style control over responses.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal