ClawHub

Task Router

Security checks across malware telemetry and agentic risk

Overview

This is a simple automatic task-routing skill, with no executable code or hidden install behavior, but users should know it may delegate requests based on broad keywords.

Install only if you want automatic task delegation. Review and trust the named downstream agents and skills first, especially for prompts involving trading, private files, documents, calendars, business data, or personal information; consider adding confirmation or narrower routing rules in your agent setup.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

High
Confidence
96% confidence
Finding
The skill declares automatic triggering for any user task without a clear scope, confirmation step, or narrow activation criteria. In a routing skill, this can cause unintended interception and delegation of unrelated requests to other agents or tools, increasing the chance of mis-execution, data exposure to the wrong downstream component, or surprise tool usage.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The routing table uses broad, everyday keywords such as 报告, 文章, 内容, 项目, and 分析 that can appear in many benign prompts, making accidental routing likely. Because this skill forwards requests to specialized agents/skills, weak matching can send user data to an inappropriate target or invoke capabilities the user did not intend to use.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal