ClawHub
Back to skill

Security audit

🎣 BigFish · AI钓鱼助手（钓点分析·鱼情分析·钓点分享）| Spot Analysis · Fish Activity · Share Spots

Security checks across malware telemetry and agentic risk

Overview

BigFish is a coherent fishing assistant skill with only text/YAML knowledge files, but users should be mindful that fishing logs and locations can be sensitive.

Install only if you are comfortable sharing fishing photos, city or spot information, weather context, and catch logs with the agent. Prefer coarse locations for sensitive fishing spots, and avoid recording private locations unless you understand where your agent stores skill-generated logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list includes broad, conversational phrases such as “打龟了” and “今天适合钓鱼吗,” which could overlap with normal chat and cause unintended skill activation. In an agent ecosystem, accidental invocation can expose user context to the skill or lead to unexpected actions, especially when the skill may then request location or analyze uploaded images.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly supports recording fishing logs with location, time, catch data, and optionally user position, but provides no visible privacy notice, retention policy, or consent flow. This creates a privacy risk because repeated logs can reveal a user's habits, frequented locations, and potentially sensitive geolocation patterns if the data is stored, shared, or surfaced unexpectedly.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.