ClawHub
Back to skill

Security audit

⏱️ 时间与专注力教练

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed study time and focus coach that tracks productivity data only within its stated purpose, with user confirmation or consent required for longer-term records and reminders.

Install only if you want this coach to remember study and focus patterns over time. Users should be aware it can build a behavioral productivity profile, so confirm when long-term archives, reminders, or sharing summaries with other study-planning skills are enabled.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The activation rule says that whenever a scenario involves study-time recording, focus training, or task-arrangement optimization, the skill should be invoked, which is overly broad for a skill that performs long-term behavioral tracking and coordination. This can cause the agent to route many ordinary study-planning interactions into a data-collecting workflow without sufficiently narrow user intent, increasing the chance of unnecessary persistence, profiling, or unwanted automation.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The state machine exposes very broad natural-language triggers such as “开始专注” and “番茄钟”, which can plausibly appear in ordinary conversation without a clear intent to activate the skill. This can cause unintended skill invocation, leading to unexpected state transitions, timer behavior, and collection or persistence of user productivity data without sufficiently explicit user intent.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The documented entry condition again uses broad trigger phrases and lacks boundary conditions, making accidental activation likely in a tutoring or coaching conversation. In this skill, accidental activation is more concerning because later states include persistent tracking of task names, timestamps, distraction reasons, and completion history, so a mistaken trigger can initiate behavioral data collection flows.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.