ClawHub
Back to skill

Security audit

frontend-skill

Security checks across malware telemetry and agentic risk

Overview

This is a simple frontend-development instruction skill with disclosed defaults and no executable code or hidden data access.

Install this only if you want a general frontend-development helper that may activate for many frontend or web-development prompts. Specify your preferred stack and constraints when prompting, and review generated code before running or installing dependencies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list contains broad phrases like '前端开发', '创建页面', and 'web开发' that are likely to appear in many ordinary conversations, increasing the chance of unintended skill activation. In an agent environment, overbroad activation can route user requests into this skill unexpectedly, causing unauthorized context influence, policy bypass attempts through skill instructions, or accidental execution of the wrong development workflow.

Natural-Language Policy Violations

Low
Confidence
75% confidence
Finding
The description states that when users do not specify a stack, the skill defaults to a specific modern frontend stack. This is not a direct code-execution flaw, but it can steer outcomes without explicit user consent, which may lead to unexpected dependency choices, incompatible project scaffolding, or supply-chain exposure if packages are introduced automatically in downstream workflows.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.