ClawHub
Back to skill

Security audit

Card Identity

Security checks across malware telemetry and agentic risk

Overview

This skill only helps resolve ambiguous credit card names to exact variants and does not request unusual access or perform actions on user data.

Installers should expect this skill to help identify exact credit card variants from shorthand names. Review companion shared card-policy resources if packaged separately, since this file depends on them for issuer support and normalization details.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
4. Apply ambiguity rules from [../card-shared/card-identity-rules.md](../card-shared/card-identity-rules.md).
5. When the match is confident, keep identity in the hidden YAML keys from [../card-shared/normalization-rules.md](../card-shared/normalization-rules.md). When it is not confident, stop and return a numbered choice list.

## Output Rules

- Do not merge facts across variants.
- If a personal and business version both fit and the user did not specify which one, return both and stop.
Confidence
85% confidence
Finding
Output Rules

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.