ClawHub
Back to skill

Security audit

Dog

Security checks across malware telemetry and agentic risk

Overview

This is a coherent dog-care skill that stores optional local records and does not show hidden execution, external data sharing, or destructive behavior.

Install only if you want local dog-care memory. During setup, choose explicit or dog-specific activation if casual dog mentions should not trigger it, and store only the vet, medication, microchip, insurance, sitter, and household details you are comfortable keeping in ~/dog/.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The activation rules are left as open-ended placeholders ('Use automatically when', 'Ask first when', 'Never activate for') without required constraints or examples. In a memory-enabled agent, this can lead to overly broad automatic activation, causing the skill to engage on ambiguous pet-related conversations and potentially collect, retain, or act on sensitive health and household information without clear user intent.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The setup instructs the skill to activate whenever the user mentions a dog, puppy, foster, or dog-care task, which is broader than explicit invocation and can cause the skill to engage on ordinary conversation unexpectedly. That increases the chance of unsolicited data collection, inappropriate context switching, and accidental file-writing prompts in situations where the user did not intend to use this skill.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.