ClawHub

Phy Pr Size Splitter

Security checks across malware telemetry and agentic risk

Overview

This skill is a transparent PR-size analysis helper that reads git or GitHub PR diffs and produces split guidance, with no hidden code or persistence shown.

Install only if you are comfortable with the agent reading local or GitHub PR diffs. Prefer invoking it explicitly with /pr-size, verify which GitHub account gh is using, and review any generated comment, branch, or PR creation command before allowing it to modify GitHub.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrase "review this diff" is broad enough to match ordinary developer conversation, which can cause the skill to activate unexpectedly in contexts where the user did not intend to run diff analysis. In an agent setting, unintended invocation can expose local repository metadata or cause the agent to execute gh/git commands on sensitive worktrees without clear user consent.

Vague Triggers

Medium
Confidence
97% confidence
Finding
Phrases like "atomic commits," "pr hygiene," and "how do I split this" are common conversational text and are insufficiently specific for a command trigger. This increases the chance of accidental skill execution, which is especially risky because the skill can inspect local branches and PR state via git and gh.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal