ClawHub

SG Scripture Commentary

Security checks across malware telemetry and agentic risk

Overview

This is a simple scripture commentary formatting skill with disclosed URL fetching and user-approved file output, and no hidden code or persistence.

Install this if you want a Chinese-style scripture commentary helper. Use source URLs and output paths you are comfortable giving to the agent, and review overwrite prompts carefully. Static and advisory scans were clean or low-risk, and pending VirusTotal telemetry was not treated as an adverse signal.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger description is broad enough to activate on common requests like 'explain this scripture' or 'annotate this text' across many contexts, which can cause the skill to take over requests that may not actually require this workflow. Over-broad activation increases the chance of unintended file-writing, URL-fetching, and path-handling behavior being introduced into ordinary conversations, expanding attack surface and causing misrouting of user intent.

Natural-Language Policy Violations

Medium
Confidence
86% confidence
Finding
The format rules mandate Chinese output conventions without stating that this is optional or user-selectable, which can override user preferences and produce content in an unexpected language. While not directly a code-execution risk, forced language behavior can cause integrity and usability issues, especially if the skill is invoked for non-Chinese users or multilingual workflows.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal