ClawHub
Back to skill

Security audit

Sofagent Lite

Security checks across malware telemetry and agentic risk

Overview

This skill is a small, disclosed behavior-guidance skill that installs one rules file and does not show hidden data access, networking, persistence, or destructive behavior.

Install this only if you want a Chinese-language baseline rule set to influence agent behavior broadly. The installer is limited to copying the skill file into a user-level skill directory, but the rules are intentionally global, so users should review them before making them part of their normal agent context.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger conditions are broad and subjective, such as 'Agent行为偏离目标' and '需要快速建立约束', which can cause the skill to activate in situations not clearly intended by the user. Over-broad activation can unexpectedly inject restrictive behavioral rules into unrelated tasks, potentially overriding normal workflow expectations or creating unsafe policy interference.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.