ClawHub
Back to skill

Security audit

generation-quality-checklists

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only media generation quality guide; its seed, diversity, logging, and approval instructions are disclosed and fit the stated QA workflow.

Install only if you want an opinionated Pruna media-generation QA workflow. Expect it to make the agent state ritual seeds, vary prompts, inspect generated files, and keep manifest-style metadata such as prediction IDs and output URLs; review linked generation tools separately before using paid APIs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The file materially exceeds the skill's stated purpose of reviewing already-generated media quality and instead instructs the agent to perform generation planning, prompt construction, seed rituals, and diversification policy. This scope drift can cause the agent to take unauthorized actions, override user intent, or inject unrelated generation behavior during a review workflow.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The document prescribes concrete operational behavior—always run a random-seed ritual, derive axes, vary outputs, and log generation metadata—that grants the skill latent control over content creation rather than simple evaluation. In an agent system, this kind of hidden capability expansion increases the risk of prompt/instruction hijacking, unintended tool use, and policy bypass through mislabeled skill content.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
The file imposes a mandatory pre-generation ritual that requires the agent to emit a specific seed statement and follow a fixed workflow before each generation, regardless of user preference. This creates an instruction-priority and autonomy issue: it can force unsolicited disclosures or process steps into user interactions and may cause the agent to act on skill-defined ceremony rather than the user's requested workflow.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.