ClawHub

Xiaohongshu Viral Content

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Xiaohongshu copywriting helper with no executable code, credential access, network use, or persistence.

Safe to install from an artifact-security perspective. Review generated marketing copy for accuracy, compliance with Xiaohongshu and advertising rules, and do not rely on the claimed viral metrics as guaranteed outcomes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill exposes very broad trigger phrases like '帮我写一篇小红书，主题是XX' and '优化这篇小红书内容', which are indistinguishable from ordinary user requests about writing or editing content. In agent environments that auto-route based on semantic similarity, this can cause unintended activation of the skill and silent prompt/context capture for requests the user did not explicitly intend to send to this skill.

Vague Triggers

Low
Confidence
89% confidence
Finding
The quick-start section uses a generic example request about recommending an AI tool, which is broad enough to overlap with many unrelated assistant tasks. This increases the chance that the platform may activate this marketing-oriented skill on common requests, leading to overbroad routing, possible disclosure of user prompts to the skill, and unexpected behavior.

VirusTotal

48/48 vendors flagged this skill as clean.

View on VirusTotal