ClawHub
Back to skill

Security audit

Victorian English

Security checks across malware telemetry and agentic risk

Overview

This skill only rewrites user-provided text into ornate Victorian-style prose, with a minor activation-scope ambiguity around the word "translate."

Before installing, be aware that terse requests using "translate" may be routed to this Victorian restyling skill when you intended ordinary language translation. Use explicit phrasing such as "rewrite in Victorian English" or a dedicated translation skill for other languages.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill is scoped as a Victorian-English restyling tool, but the instructions expand behavior to perform ordinary translation whenever the user names another target language. That creates scope drift and can cause the agent to intercept requests outside its declared capability, leading to incorrect routing, policy bypass of more appropriate translation skills, or unexpected handling of multilingual content.

Vague Triggers

Medium
Confidence
89% confidence
Finding
Allowing a bare trigger phrase such as "translate" is overly broad because it overlaps with common user intent for normal language translation rather than Victorian restyling. In a multi-skill environment, this can cause accidental invocation, misrouting, and unintended transformation of user content when the user expected a different function.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The instruction to treat minimal requests like "translate I am busy" as complete invocations repeats and operationalizes an ambiguous trigger, increasing the chance that ordinary translation requests will be captured by this stylistic skill. The danger is primarily incorrect tool activation and user-intent confusion, not code execution, but it can still degrade safety and reliability in orchestration systems.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.