ClawHub
Back to skill

Security audit

Capability Evolver

Security checks across malware telemetry and agentic risk

Overview

This is a local log-analysis skill whose behavior matches its stated purpose, with routing and sensitive-log handling cautions but no evidence of malicious activity.

Install it only if you want an agent to analyze runtime logs. Redact credentials, tokens, personal data, and sensitive internal details before sending logs, and review recommendations before turning them into automated tasks or long-lived records.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The description says to use the skill when the user or agent asks to analyze logs, diagnose failures, improve reliability, generate evolution proposals, or assess system health. These are broad, common phrases without gating conditions, so an orchestrator may invoke the skill in situations where the user did not explicitly request this capability or where log data is sensitive and should not be processed by a self-improvement component. In a meta-skill that can influence agent behavior and generate improvement proposals, over-broad invocation increases the chance of unintended activation and inappropriate processing.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The "When to Use" section includes vague prompts like "what's failing", "improve my agent", and "check system health" without boundaries or disambiguation. In an agent environment, these everyday phrases can match many unrelated user intents and cause the skill to run unexpectedly, potentially consuming internal logs or steering the agent into self-modification workflows that were not clearly authorized. Because this is a capability-evolution skill, accidental invocation carries more risk than a narrow read-only utility.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.