ClawHub

ClawLodge

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed ClawLodge registry helper skill; its download, install, publish, telemetry, and credential-related behavior is purpose-aligned but should be used deliberately.

Before installing, verify the clawlodge-cli npm package source, inspect packages with show/get before download or install, confirm any publish/comment/report action explicitly, and disable telemetry if you do not want anonymous command-level usage sharing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill defines broad Chinese trigger phrases such as '帮我装一个...龙虾' and '给我装一个...龙虾' that can plausibly appear in casual conversation, then maps them to package-registry actions. This can cause unintended skill invocation and downstream actions like search, download, or install based on ambiguous natural language rather than explicit user confirmation.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to treat certain Chinese phrases as automatically mapping to CLI and registry workflows, including setup/install semantics, without first verifying that the user intended a software action. This bypasses normal consent and language disambiguation, increasing the risk of unauthorized downloads or installations from a third-party registry.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal