ClawHub
Back to skill

Security audit

suansuan-10agents

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Chinese finance-advisor prompt skill with an overly broad activation phrase, but it contains no code, credential access, persistence, or hidden actions.

Install this only if you want a Chinese-language finance and business-analysis assistant. Be aware it may activate for ordinary mentions of money, and avoid sharing sensitive financial details unless you are comfortable with how your agent platform stores and processes chat content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

High
Confidence
95% confidence
Finding
The trigger condition is explicitly overbroad: it says the skill must activate whenever a user discusses finance-related topics and even 'anything involving money.' This can cause the agent to invoke the skill for many ordinary conversations where a specialized finance persona is unnecessary, increasing the chance of misrouting, over-collection of sensitive financial data, or giving authoritative financial guidance in the wrong context.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.