ClawHub
Back to skill

Security audit

Eai Awesome Work

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed newsletter-writing workflow that fetches public arXiv pages and writes a Markdown digest, with no evidence of hidden, destructive, or credential-seeking behavior.

Install this if you want an automated Chinese Markdown digest of embodied-AI papers. Be aware that broad phrases like "awesome work" may activate it unexpectedly, and its output is designed for Chinese-language publishing unless you explicitly ask your agent otherwise.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger conditions include very broad phrases such as "awesome work" and "具身论文汇总", which can match ordinary conversation or unrelated requests and cause unintended skill activation. In an agent setting, overbroad activation increases the chance that the skill performs network fetching and content generation when the user did not explicitly request this workflow, creating prompt-routing confusion and possible misuse of external browsing capabilities.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The writing rule mandates Chinese output without offering a user override, which can cause the agent to ignore the user's language preference or downstream system expectations. This is primarily a policy and usability risk rather than a direct security flaw, but it can still lead to unexpected behavior, reduced transparency, and failures when integrated into multilingual workflows.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal