ClawHub
Back to skill

Security audit

☕ 兴趣成长探索计划

Security checks across malware telemetry and agentic risk

Overview

This is a non-executable interest-exploration coaching skill with a somewhat broad trigger scope but no hidden privileged behavior.

Before installing, consider narrowing use to explicit interest-exploration or 52-week tracking conversations. If used with students, treat the recorded reflections and any parent summaries as personal information and share or persist them only with clear consent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The instruction that the skill should be invoked for essentially any interest exploration, self-awareness, or growth-planning scenario creates an overly broad activation scope. This can cause the agent to over-select this skill in common conversations, crowding out more appropriate skills, increasing unnecessary data collection, and making system behavior easier to steer through generic prompts.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The example trigger phrases are broad, everyday statements such as not knowing one's interests or wanting self-discovery help, without clear scope boundaries. Because these phrases are common across many benign conversations, they can lead to accidental or manipulative skill activation, which weakens routing integrity and may expose personal reflection data to a skill more often than necessary.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.