ClawHub
Back to skill

Security audit

Dandan File Organizer

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only file organizer that scans and moves user-selected files after confirmation, with no evidence of hidden or destructive behavior.

Before confirming any organization step, review the target folder, proposed moves, and generated log path. Avoid using it on highly sensitive directories unless you are comfortable with filenames and folder paths being shown in chat or saved in local rollback logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases include broad everyday expressions like '桌面太乱了' and '文件太多了', which can cause the skill to activate when a user is merely complaining rather than explicitly consenting to file operations. In a skill that scans and later moves files, accidental activation increases the chance of unintended filesystem access and user confusion.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.