ClawHub
Back to skill

Security audit

AI 行业资讯雷达

Security checks across malware telemetry and agentic risk

Overview

This is a transparent AI-news lookup skill that uses a declared external API token, with no evidence of hidden persistence, destructive behavior, or unrelated data access.

Install only if you are comfortable sending AI-news search terms and article IDs to the Jiqizhixin API. Keep JQZX_API_TOKEN secret, avoid committing or printing it, leave BASE_URL pointed at a trusted endpoint, and avoid using confidential company names or research topics as search keywords unless that disclosure is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The workflow explicitly instructs the agent to use its own memory to expand search keywords, while elsewhere the skill forbids relying on LLM memory for factual AI-industry answers. This contradiction can cause the agent to introduce hallucinated entities, topics, or biased search pivots, contaminating retrieval results and producing inaccurate or manipulated conclusions that appear grounded in external data.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.