ClawHub
Back to skill

Security audit

Chinese Almanac

Security checks across malware telemetry and agentic risk

Overview

This skill is a local Chinese almanac date-selection tool with some overly broad activation phrases but no evidence of unsafe system access or hidden behavior.

Safe to install for local almanac-style date selection, but users and maintainers should narrow the trigger phrases, especially removing "時計". Treat the output as cultural or entertainment guidance, not professional, legal, financial, medical, or safety advice; the documentation also links to an external demo site, which is separate from the local CLI behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger set includes broad phrases that can match ordinary conversation, causing the skill to activate outside clearly intended almanac requests. Unintended activation can hijack user intent, inject irrelevant guidance, or suppress more appropriate skills, which is a security-relevant routing and scope-control issue in agent environments.

Vague Triggers

Medium
Confidence
92% confidence
Finding
Several listed triggers are vague or collision-prone, especially terms like generic 'pick a good day' and non-obvious terms such as '時計', which may match unrelated requests. In an agent ecosystem this broad matching can cause misrouting, unexpected invocation, and user confusion, increasing the attack surface for prompt-routing abuse even though the skill itself is not overtly malicious.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.