ClawHub
Back to skill

Security audit

Pre judgment of similar cases wdy

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed legal lookup helper that sends case descriptions to a third-party API for law and case retrieval, with no hidden install scripts or persistence.

Install only if you are comfortable sending legal dispute summaries to Wendaoyun's API. Avoid including names, ID numbers, addresses, account details, or other unnecessary sensitive facts unless you have decided that disclosure is appropriate.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list uses broad, everyday dispute terms such as '纠纷', '被骗', and '打官司', which can cause the skill to activate on routine conversation or ambiguous user input. Because the skill sends user-described case details to a third-party API, unintended activation increases the chance of transmitting sensitive legal and personal information without sufficiently explicit user intent.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.