ClawHub
Back to skill

Security audit

📖 智能词汇DNA系统

Security checks across malware telemetry and agentic risk

Overview

This is a vocabulary learning skill that openly uses local memory and optional reminders for spaced repetition, with privacy considerations but no hidden or destructive behavior found.

Before installing, users should be comfortable with the skill saving vocabulary history, example sentences, and learning performance in local memory, and should only enable IM reminders after explicit consent. Avoid putting sensitive personal details into practice sentences if those may be resurfaced in later reviews or reports.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The instruction that "凡是涉及英语单词记忆、词汇积累、课前预习的场景，务必调用此SKILL" pushes activation across a very broad set of normal educational conversations. Overbroad invocation can cause unnecessary collection, retention, and reminder setup for users who did not specifically ask for this workflow, increasing privacy and consent risk even if the skill is not overtly malicious.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases include common requests like "帮我记单词" and "帮我复习词汇," which are broad enough to match ordinary tutoring interactions that may not require persistent storage or scheduled reminders. This creates a risk of unintentionally routing users into a memory-tracking skill and retaining learning data beyond what they expected.

Ssd 3

Medium
Confidence
93% confidence
Finding
This section instructs the system to retain user-generated sentences and usage history in the vocabulary DNA for future reminders and summaries. Because those sentences may contain personal details about the student's life, storing and resurfacing them later creates a privacy risk and possible unintended disclosure through reminders, reports, or cross-skill memory reuse.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.