ClawHub
Back to skill

Security audit

copywriting-hooks

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only copywriting helper; its scope wording should be clarified, but the artifacts do not show harmful or hidden behavior.

Installers should treat this as a low-risk writing aid. Before installing, be aware that it may trigger on broad hook, intro, headline, or title requests, and its platform guidance should be clarified if you need strict separation from social posts or email subject-line workflows.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill's title guidance explicitly covers LinkedIn feed, newsletter subjects, and X/Twitter constraints even though the manifest says the skill must not trigger for social posts or email subjects/openers. This inconsistency can cause the agent to activate or be repurposed outside its declared scope, leading to policy drift, incorrect routing, and unintended handling of excluded content types.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The documentation is self-contradictory about whether the skill handles LinkedIn feed and newsletter-style titling: the top-level description excludes those formats, while later sections provide operational guidance for them. In agent systems, contradictory instructions are dangerous because dispatch logic may follow the wrong branch, causing unintended invocation and unreliable behavior.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger description is very broad, covering many common terms like hook, opening, intro, first sentence, opener, headline, and title. Such broad matching increases the chance of accidental invocation for generic writing or editing requests, which can override more appropriate skills and create unsafe or low-quality workflow selection.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.