ClawHub
Back to skill

Security audit

feature-modification-workflow

Security checks across malware telemetry and agentic risk

Overview

This skill is a broad but transparent coding workflow for changing existing features, with no hidden installer, scripts, credentials, or persistence.

Install this only where you want an agent to help modify code. Because the trigger is broad, review diffs before committing and consider narrowing activation if you prefer the skill to run only on explicit feature-change requests.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger conditions are broad and include common phrases like "fix a bug," "optimize xxx," and "any request involving feature modifications," which can cause the skill to activate in many unrelated contexts. Over-broad activation increases the chance the workflow overrides more appropriate skills or initiates code-modification behavior without sufficient scoping, leading to unintended changes or unsafe autonomy.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.