ClawHub
Back to skill

Security audit

using-overpowered

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed orchestration skill that routes tasks to other Overpowered methods and does not itself install code, persist data, or request hidden privileges.

Install this if you want an orchestrator for the Overpowered suite. Be aware it may activate for broad enterprise or knowledge-work tasks and may recommend other skills, including automation or durable-skill creation paths, so review those downstream skills separately before granting them sensitive access or mutation authority.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The activation criteria are very broad, covering many common knowledge-work and automation scenarios, which can cause the orchestrator skill to activate for loosely related tasks and take over routing decisions too early. In a security context, over-broad invocation increases the chance of unnecessary tool/skill chaining, expands the attack surface, and can amplify the effect of any downstream unsafe skill selection.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Interaction rule

If a skill can discover a fact from tools or artifacts, do not ask the user for that fact. Ask humans for intent, decisions, unavailable tacit knowledge, authority, or approval required by risk policy.

## Adaptive capability rule
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.