ClawHub
Back to skill

Security audit

通联VIP对账单配置

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed business workflow for creating and sharing a VIP reconciliation Excel file, with no hidden code, persistence, or malware signal found.

Install only if this matches your internal 通联 VIP reconciliation process. Before sending, verify the merchant and terminal data, confirm 康文博 is the intended recipient, and make sure sharing the attached Excel file is allowed under your organization's data-handling rules.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases are very broad and overlap with common business-language requests, which increases the chance the skill is invoked for loosely related conversations or with incomplete context. In this skill, unintended invocation can lead to generation and onward sharing of merchant identifiers and terminal data, so accidental activation has real data-handling consequences.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The workflow instructs the agent to send a generated file containing merchant/account data to another person and create a task, but it does not require any authorization, data-classification check, or user confirmation before disclosure. Because the file includes sensitive business identifiers, this creates a material risk of unauthorized internal sharing, over-sharing, or accidental exfiltration through messaging/task systems.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.