Security audit
Web Novel Writing Assistant
Security checks across malware telemetry and agentic risk
Overview
The available scan signals and artifact context do not show hidden, deceptive, or purpose-mismatched behavior.
Installation appears acceptable based on the available evidence. Users should still treat any repo, GitHub, Convex, or moderation commands as high-impact operations: run them only for the intended ClawHub workflows, verify the target before write actions, and avoid providing production credentials unless they are needed for that task.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.