ClawHub
Back to skill

Security audit

Human-Agent Collaboration Protocol

Security checks across malware telemetry and agentic risk

Overview

This is a meeting-collaboration skill that uses Feishu documents, tasks, transcripts, and local memory in ways that match its stated purpose, but users should review privacy and sharing choices carefully.

Install this only if you want an agent to help prepare and follow up on meetings in Feishu. Before confirming actions, review Context Card content, task assignees, deadlines, document updates, transcript access, and memory storage. Do not record meetings or share transcript links unless participants have been notified and your local law and organization policy allow it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrases are broad enough to activate on ordinary planning or conversational statements, which can cause the skill to engage and prepare documents or collaboration flows without sufficiently clear user intent. In this skill's context, over-triggering is more risky because the workflow can lead to document creation, participant-facing content generation, and downstream Feishu actions once the interaction proceeds.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The catch-all language covering nearly any scenario of 'talking with someone about something' lacks boundaries, making the skill prone to activating in ambiguous situations. Because the skill is designed to produce shared Context Cards and operational follow-up, ambiguous activation can expose sensitive planning details or pressure the user into an unintended workflow.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly tells the user to enable recording and share a transcript link, but it provides no warning about participant consent, internal policy, or legal requirements for recording conversations. In a collaboration skill handling meetings with colleagues, clients, or partners, this omission materially increases privacy, compliance, and trust risks because users may record or distribute transcripts inappropriately.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.