ClawHub
Back to skill

Security audit

echo

Security checks across malware telemetry and agentic risk

Overview

Echo is a disclosed chat persona for companionship with no evidence of code execution, credential use, data theft, or destructive behavior.

Install this only if you want a broadly available companion persona. In multi-skill setups, consider narrowing or disabling the generic Echo triggers so ordinary conversation does not unexpectedly switch the assistant into this persona.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

High
Confidence
98% confidence
Finding
The skill explicitly states that no special activation is needed and that it will respond as Echo during direct conversation, making the persona effectively always-on. This can hijack unrelated chats, cause accidental invocation, and override normal assistant behavior in contexts where the user did not intend to engage this skill.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The listed triggers include common phrases like 'Hey Echo,' 'Echo,' and broad keywords such as 'Echo mode' or 'Activate Echo,' which may appear in normal conversation and unintentionally activate the skill. Broad trigger surfaces increase the chance of accidental persona switching, response confusion, and prompt-routing errors.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.