ClawHub

头条新闻

Security checks across malware telemetry and agentic risk

Overview

This skill is a public AI-news roundup workflow that asks the agent to search, cross-check, and summarize sources, with no code execution or private-data access.

Install this if you want Chinese AI-news roundups and are comfortable with the agent performing multiple public web searches. For ambiguous AI questions or non-news tasks, invoke a more specific skill or state that you do not want a news roundup.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The skill advertises broad, everyday trigger phrases like '今天有什么 AI 新闻' and 'AI 圈最近在讨论什么' without clear boundaries on when it should or should not activate. In agent environments, overly broad activation increases the chance of misrouting unrelated user requests to this skill, causing inappropriate tool use, unnecessary browsing, or incorrect responses based on the wrong workflow.

Natural-Language Policy Violations

Medium
Confidence
81% confidence
Finding
The skill sets '输出语言：中文' as the default without indicating that user language preference should override it. This can lead to responses in an unexpected language, which is primarily a safety and usability issue but can also cause miscommunication or conceal important nuance if the user expected another language.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal