ClawHub
Back to skill

Security audit

Viral Trend Catcher

Security checks across malware telemetry and agentic risk

Overview

This skill is a social-commerce trend advice tool with broad activation wording, but it does not show hidden execution, credential use, data access, persistence, or unsafe automation.

Install this if you want fast advice on whether social-trending products are worth testing. Be aware it may activate for some broad marketing or stocking questions, and treat its sourcing and ad-budget recommendations as business advice to verify before spending money.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The frontmatter trigger guidance is overly broad and explicitly says to use this skill even for generic queries like product promotion if trend-catching might apply. That can cause the skill to activate outside its intended scope, overriding more appropriate skills and producing mismatched advice. In this context, the skill is commercial/marketing-oriented rather than directly handling dangerous capabilities, so the main risk is misrouting, poor guidance, and unintended behavior rather than severe security harm.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The usage section reinforces ambiguous activation by stating the user does not need to mention viral trends explicitly and then lists broad prompts such as 'should I stock this' and 'I want to sell something with strong visual impact.' This increases the chance of unintended invocation on routine merchandising or marketing questions, which can distort the assistant's behavior and bypass better-matched skills. The surrounding scope limitations help somewhat, but they are weaker than the aggressive trigger language, so the net effect remains unsafe from a skill-routing perspective.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.