ClawHub
Back to skill

Security audit

ia-meta-prompting

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed prompt-style helper that can change how the agent analyzes answers, with no evidence of hidden code, credential access, persistence, or data exfiltration.

Install this if you want the agent to automatically apply structured review patterns in design, security, validation, and architecture discussions. Avoid it if you prefer these formats only when explicitly requested, because it may change answer structure in common technical conversations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill explicitly supports auto-triggering based on broad natural-language context such as when "context warrants," which can cause the modifier skill to activate without an explicit user request. In a prompt-routing system, this creates unintended instruction injection risk: the skill may alter response format, reasoning workflow, or validation behavior in contexts where the user did not ask for it, potentially interfering with higher-priority task handling or other security-sensitive skills.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The file defines multiple vague and overlapping auto-trigger conditions such as security, validation, architecture decisions, ambiguous requirements, unfamiliar areas, and code review requests. Because these contexts are common across many conversations, the skill may activate unexpectedly and stack multiple behavioral modifiers, causing prompt-routing confusion, unrequested output transformations, or accidental suppression/distraction from the primary task; the instruction to accept new pattern definitions mid-conversation further increases unpredictability.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.