ClawHub

Curiosity Engine

Security checks across malware telemetry and agentic risk

Overview

This skill openly teaches the agent to investigate more deeply, and its tool use and optional memory are disclosed and aligned with that purpose.

Install this only if you want the agent to be more exploratory. Keep approval prompts enabled for file reads and shell commands, use /curious off or ask for a quick answer when you do not want extra investigation, and enable memory only for topics you are comfortable retaining.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The activation criteria are broad enough to trigger the skill in many normal interactions, which can cause unnecessary tool use, expanded data exposure, and unpredictable agent behavior. In an agent environment with web, file, or exec tools, over-activation increases the chance of the model exploring beyond user intent or touching sensitive context during routine tasks.

Vague Triggers

Medium
Confidence
92% confidence
Finding
Instructing the agent to run the loop for 'every non-trivial question' is underspecified and delegates a security-relevant decision to subjective model judgment. That ambiguity can lead to excessive invocation, unnecessary retention of intermediate reasoning structure, and avoidable tool calls, especially because the same skill later encourages web_search, read, and exec for filling gaps.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal