ClawHub
Back to skill

Security audit

Assistant

Security checks across malware telemetry and agentic risk

Overview

This appears to be a general personal-assistant skill with broad but disclosed guidance and no evidence of hidden code, exfiltration, destructive actions, or persistence.

Install only if you want a general assistant-style skill active across planning, communication, and scheduling tasks. Review prompts carefully before allowing it to draft messages, change calendars, or reuse sensitive personal information.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill description is broad enough to authorize task management, communications, scheduling, information handling, and proactive support without clear activation boundaries or scoped permissions. In an agent system, this can lead to overreach, where the skill is invoked in situations involving sensitive emails, calendars, notes, or follow-up actions beyond what the user explicitly intended.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.