ClawHub
Back to skill

Security audit

📚 语文素材库2.0

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Chinese writing-material library, but users should understand that it stores and tracks student writing materials over time.

Install this if you want a persistent study aid for Chinese writing materials. Before using it with students, especially minors, decide how saved quotes, self-written sentences, usage history, and monthly summaries should be reviewed or deleted, because the skill does not define retention or deletion controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill explicitly says it should be invoked for nearly any scenario involving Chinese writing-material accumulation or preparation, which creates an overly broad activation surface. This can cause unnecessary invocation, unexpected data collection, and interference with user intent by pulling the skill into ordinary education conversations where the user did not clearly request persistent storage or retrieval.

Vague Triggers

Medium
Confidence
92% confidence
Finding
Trigger phrases such as '记一下这个' or '好，记下来' are common conversational expressions and may appear in many contexts unrelated to persistent storage. Because the skill treats them as activation commands, normal dialogue could unintentionally save student content or invoke the skill without meaningful consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The description advertises storage, proactive pushing, usage tracking, and monthly reporting, but it does not present a clear user-facing notice about retention, persistence, or monitoring of student content. In an education context involving minors, silent accumulation of writing material and behavior data raises privacy and consent concerns, especially if users may not realize their content is being stored long term.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill describes monthly reports, usage analytics, and sharing summaries with other skills, including learning-profile systems, without a strong disclosure and consent model. Cross-skill data sharing and longitudinal reporting expand the privacy impact because they can reveal learning habits, writing themes, and behavioral patterns beyond the immediate task.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.