ClawHub
Back to skill

Security audit

希沃白板原生插件开发技能

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent EasiNote native plugin development guide with broad host-plugin guidance but no hidden execution, persistence, exfiltration, or destructive behavior in its artifacts.

Before installing, treat this as advanced guidance for building plugins that run inside EasiNote and can affect the host UI and document state. Use it only for EasiNote native plugin work, keep UseEasiNote at the minimum level that compiles before release, avoid telemetry or package contents that include sensitive data, and require explicit user confirmation for restart or exit flows.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Low
Confidence
86% confidence
Finding
The example explicitly recommends `UseEasiNote=all`, which grants a plugin a broader host capability surface than needed for a simple text-counting feature. In a plugin-development skill, normalizing over-privileged templates increases the chance that downstream plugins ship with unnecessary access, expanding blast radius if the plugin is later compromised or misused.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill declares extremely broad auto-trigger conditions, including mandatory use whenever certain terms are mentioned and even when the user did not explicitly request the skill. This can cause inappropriate routing, over-collection of context, and accidental application of powerful in-process plugin guidance to loosely related conversations, increasing the chance of unsafe or irrelevant actions.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.