ClawHub
Back to skill

Security audit

Naming Expert

Security checks for vulnerabilities and agentic risk

Overview

This is a simple naming-assistance skill with no executable code, sensitive access, or persistence; the only caveat is broad activation wording.

Before installing, understand that this skill may activate for short, vague requests about names. It is otherwise low risk: it only guides the agent’s naming workflow and does not add code execution, data access, persistence, or account authority.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill explicitly treats vague everyday phrases like '帮我想个名字' or '取个好名' as activation triggers, which can overlap with ordinary conversation and cause over-broad invocation. This is dangerous because it can hijack general chat flows, reduce user intent fidelity, and cause the agent to enter a constrained naming workflow when the user may have meant something else, increasing the chance of irrelevant or policy-misaligned behavior.

Static analysis

No suspicious patterns detected.