ClawHub
Back to skill

Security audit

What To Eat

Security checks across malware telemetry and agentic risk

Overview

This is a simple meal recommendation skill with no code execution, credentials, file access, or hidden behavior.

Install this if you want casual meal suggestions. Tell the agent any allergies, dietary restrictions, budget, or preferred language when asking for recommendations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The manifest includes broad trigger phrases such as general food suggestions and everyday "what should I eat" requests, which can cause the skill to activate for a wide range of common conversations. This is not overtly malicious, but it can lead to over-selection of the skill, reducing routing precision and potentially crowding out more appropriate skills.

Natural-Language Policy Violations

Medium
Confidence
81% confidence
Finding
The skill content is written to operate in Chinese only and does not provide a language fallback or ask the user for their preferred language. In multilingual environments, this can create confusing or inaccessible interactions, especially if the skill is invoked for non-Chinese-speaking users.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal