ClawHub
Back to skill

Security audit

Detox Counter

Security checks across malware telemetry and agentic risk

Overview

This is a local detox-tracking skill with no executable code or network behavior, but users should treat its wellness guidance and symptom logs carefully.

Safe to install based on the provided artifacts. Use it only for wellness notes you are comfortable storing locally, do not rely on it for medical advice, and seek professional care for severe, persistent, or concerning symptoms. Export or share logs only intentionally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrase "start detox" is broad and likely to appear in ordinary health or wellness conversation, making accidental invocation plausible. In a health-related skill, unintended activation is more concerning because it can steer users into symptom tracking or detox guidance without a clear intentional request.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger "detox day" is ambiguous and can easily occur in normal discussion about dieting, cleanses, or progress updates. Because the skill operates in a health context, ambiguous triggering increases the chance of unintended engagement and user confusion around advice-like content.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill encourages tracking symptoms and normalizes restrictive detox protocols, including juice cleanses and elimination diets, but provides no medical disclaimer or warning about potential health risks. Statements such as symptoms spiking being "normal" may discourage users from seeking care when experiencing adverse effects, increasing the chance of harm.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
89% confidence
Finding
The phrase "start detox" overlaps with a built-in command pattern beginning with "start," creating a shadow-command risk where platform behavior or this skill may be invoked unexpectedly. Such conflicts reduce predictability and can cause accidental launches, especially in conversational wellness contexts where the phrase is natural.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.