ClawHub
Back to skill

Security audit

🛠️ SKILL创建教练

Security checks across malware telemetry and agentic risk

Overview

This is a coherent SKILL-authoring guide with disclosed memory and sharing guidance, but users should keep its templates scoped and consent-based.

Before installing, treat this as a prompt/SKILL creation coach. If you use the included templates, keep long-term memory, uploaded student materials, reminders, and cross-SKILL sharing explicitly opt-in, and narrow the activation wording if you do not want it invoked for general prompt-writing help.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The instruction '凡是涉及自定义SKILL创建、提示词撰写、SKILL调试的场景，务必调用此SKILL' is broad enough to trigger on many loosely related conversations, which can cause over-invocation and unnecessary context switching. In a meta-skill that influences other skills' prompts and memory behavior, unintended activation increases the chance of inappropriate guidance being applied outside the user's actual intent.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The sample trigger phrases include common, natural language requests such as '帮我写提示词' and '怎么让小智更懂我', which may appear in ordinary conversations without the user intending to invoke a privileged meta-skill. Because this skill teaches prompt construction, memory design, and cross-skill behavior, accidental routing could expose users to broader operational guidance than needed and interfere with normal assistant behavior.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.