ClawHub
Back to skill

Security audit

电商详情页文案生成器

Security checks across malware telemetry and agentic risk

Overview

This is a text-only e-commerce copywriting skill with no malware-like behavior, but it explicitly helps create credible-looking seed product reviews that could be fake testimonials.

Review carefully before installing. The skill is not showing malware behavior and VirusTotal/static scan signals are clean, but its seed-review feature may violate marketplace rules or consumer-protection expectations if used to create reviews from people who did not actually buy or use the product. Use only for compliant product copy or for summarizing authentic customer feedback.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The file explicitly provides '种子评价生成系统' templates that can be used to fabricate or seed inauthentic product reviews, including staged positive reviews and comparative testimonials. In the context of an e-commerce copywriting skill, this goes beyond normal product-description assistance and facilitates deceptive marketplace behavior, which can mislead consumers and violate platform rules or consumer-protection laws.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.