ClawHub

Qa Boundary Deep Dive

Security checks across malware telemetry and agentic risk

Overview

The available evidence shows a low-risk Chinese boundary-analysis skill with only minor activation and language-scoping caveats.

This appears reasonable to install if you want a Chinese-language boundary-analysis helper. Be aware it may trigger on fairly generic boundary-analysis wording, and non-Chinese users may need translated instructions or explicit language guidance.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The activation condition is broad and trigger-based (e.g. generic phrases like '边界分析' or '边界条件'), which can cause the skill to run in contexts where the user did not clearly request this specific deep-dive behavior. In an agent system, ambiguous routing increases the risk of mis-invocation, irrelevant analysis, and unintended disclosure or processing of context from upstream skills.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The skill metadata and invocation guidance are effectively Chinese-only, with no indication that the skill should adapt to the user's language. This can lead to misunderstanding of activation behavior or outputs, especially in multilingual environments, causing operator error, missed warnings, or incorrect downstream consumption of the boundary analysis.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal