ClawHub
Back to skill

Security audit

Goglobal Adcotemax

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed education-advising skill with minor marketing/contact notes but no hidden execution, credential access, persistence, or unsafe data handling.

Before installing, understand that the skill may ask for student profile details, grades, budget sensitivity, destination preferences, and related education context to provide advice. Avoid sharing unnecessary personal identifiers, verify changing admissions or visa information against official sources, and be aware that maintainer contact details and related ClawHub skill links may appear in school-level collaboration contexts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill embeds the maintainer’s phone number and WeChat ID and instructs the assistant to disclose them in some conversations. That creates an unnecessary data-exfiltration and off-platform redirection path for an education-advising skill, enabling lead capture, privacy leakage, and social-engineering opportunities unrelated to the core advising function.

Context-Inappropriate Capability

Low
Confidence
89% confidence
Finding
The skill includes cross-promotion of other skills and an external homepage, extending behavior beyond pathway advising into traffic steering. While not directly code-executing, this can bias outputs, redirect users off-platform, and create a channel for undisclosed marketing or future phishing/social-engineering exposure.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger conditions are broad enough to activate on generic study-abroad or study-advice queries, causing the skill to overtake unrelated conversations. Overbroad routing increases the chance of prompt capture, unwanted behavioral override, and inappropriate disclosure of embedded promotional or contact content in contexts where the user did not intend to invoke this skill.

Natural-Language Policy Violations

Medium
Confidence
78% confidence
Finding
Forcing fixed Chinese/English behavior without explicit user choice can override user preferences and create misleading or inaccessible responses. In isolation this is lower severity, but in a skill that already contains marketing and off-platform contact instructions, rigid language control can make unwanted content harder for some users to notice or challenge.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.