ClawHub

个性化助眠脑波音乐定制系统

Security checks across malware telemetry and agentic risk

Overview

This is a text-only Chinese sleep-audio recommendation guide with health-adjacent risks, but no hidden code, persistence, credentials, or unrelated system access.

Install only if you want a Chinese-language sleep-audio recommendation workflow. Use it with explicit user consent, do not treat it as medical diagnosis or a substitute for licensed care, and verify or replace the HTTP audio links with trusted HTTPS links before sharing them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The file distributes audio resources over plain HTTP, which allows network attackers to intercept or modify the linked content in transit. In a health-related skill that outputs personalized intervention links, this is more dangerous than a generic media catalog because users may trust the recommendation and consume tampered content presented as clinical guidance.

Vague Triggers

High
Confidence
96% confidence
Finding
The skill explicitly instructs immediate invocation for extremely broad, everyday sleep-related statements, including vague phrases like '最近睡眠不太好' and '想睡得好一点'. This can cause the agent to over-trigger into a quasi-medical screening and product-matching flow without sufficient user intent, appropriateness checks, or informed framing, increasing the risk of unwanted medicalized guidance and inappropriate recommendation of proprietary interventions.

Natural-Language Policy Violations

Medium
Confidence
72% confidence
Finding
The skill content is effectively hardcoded for Chinese-language interaction and presents a fixed Chinese diagnostic/questionnaire flow without offering language choice. In a general assistant environment, this can degrade user comprehension, impair informed consent, and increase the chance of misunderstanding during health-related questioning and recommendations.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation provides symptom-based sleep-audio selection and severity mapping for insomnia-related conditions but contains no warning, limitation, or escalation guidance for medical red flags, vulnerable populations, or cases needing clinician review. In this context, the skill is positioned as a professional assessment and intervention tool, so omission of safety boundaries can lead to inappropriate health advice, delayed care, or overreliance on the audio plan as treatment.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal