ClawHub
Back to skill

Security audit

Campaign Planning

Security checks across malware telemetry and agentic risk

Overview

This is a marketing campaign planning guide with disclosed research-tool use and no executable code or hidden high-impact behavior.

Install only if you want a Chinese-language marketing campaign planning workflow. Expect it to use web research for market and competitor context, and review any generated budgets, legal/compliance checklists, or campaign actions before using them operationally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The description is very broad and covers generic campaign planning, product launches, content calendars, and KPI definition without clear boundaries. In an agent environment, this can cause the skill to activate for many ordinary planning requests and override more appropriate skills or system behavior, increasing the chance of prompt-scope hijacking or unintended tool use.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger section lists multiple common user intents in broad terms and does not specify when the skill should not be used. This makes accidental or excessive activation more likely, which is dangerous because the skill includes guidance to use external research tools and could steer unrelated conversations into this workflow.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
The skill content is written as Chinese-only guidance and does not offer a user-language choice or justified locale restriction. This can cause instruction conflicts with the user's preferred language, reduce transparency, and in multi-skill settings create routing or interpretation errors that weaken safe and accurate agent behavior.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.