ClawHub

Design System

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only design-system helper that keeps scoped local notes and shows no malware, credential use, network activity, or destructive behavior.

Install this if you want a local design-system assistant that remembers preferences and decisions. Review ~/design-system/memory.md periodically and avoid storing confidential strategy, customer details, credentials, or sensitive internal constraints there unless you intentionally want them reused later.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The instruction to 'start the conversation naturally' when the design-system directory is missing or empty creates ambiguous activation criteria and can cause the skill to engage without an explicit user request. In an agent setting, this increases the chance of unintended behavior and can lead to unsolicited persistence actions later in the workflow.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to save user preferences and team context to ~/design-system/memory.md without requiring a user-facing notice or consent flow. This creates a privacy and transparency risk because potentially sensitive workflow details are persisted to disk automatically, and the user may not realize data is being stored.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal