Skylv Clawhub Search

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:37 PM UTC
• Version:
  1.0.3

Overview

This is a simple ClawHub marketplace helper that explains how to search for and install skills, with no hidden code or credential access in the bundle.

Install this only if you want marketplace search and skill installation assistance. Before running any suggested npx clawhub command, confirm the exact skill name and review the external package or command, because installing or syncing skills can change the agent environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger definition is broad enough that ordinary conversation about searching for skills or installing tools could activate the skill unintentionally. This can cause the agent to shift into marketplace-search behavior without clear user intent, increasing the chance of unsolicited recommendations, external lookups, or install guidance.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The automatic activation rule says to detect search/install-related keywords but does not define boundaries, exclusions, or consent requirements. In practice, this ambiguity can cause accidental invocation during normal discussion of tools or software, which is risky because the skill is designed to browse and facilitate installs from an external marketplace.

VirusTotal

64/64 vendors flagged this skill as clean.