ClawHub
Back to skill

Security audit

mba-thesis-writing-guidance

Security checks across malware telemetry and agentic risk

Overview

This is a coherent MBA thesis guidance skill with disclosed project-file scanning and file creation, but users should review and redact sensitive work details before letting it save them.

Install this only in the relevant thesis project, not globally. Before allowing it to scan or write files, review which project files it will read and ask for a preview of any YAML or work-resource.md changes. Do not include confidential employer, colleague, customer, or restricted internal data unless it is authorized and anonymized.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list includes broad phrases such as '帮我写论文' and several common thesis-related terms, which can cause the skill to activate in situations beyond its intended guardrails. Overbroad activation increases the chance the agent injects domain-specific instructions into unrelated conversations, potentially steering users toward sensitive academic-writing assistance when not appropriate.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The template explicitly tells the agent to collect user-provided work-resource details and save them into the thesis project root without requiring a warning, preview, or confirmation step. Because this content may include sensitive organizational information such as colleague identities, internal processes, records, customer details, and data-access permissions, automatic persistence can create unintended data retention and privacy exposure.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly directs the agent to scan the user's workspace and write or update `school-format.yaml` and `thesis-config.yaml` in the project root, but it does not require an immediate user-facing confirmation before modifying files. Even though these are expected thesis-project artifacts, silent file creation or modification can overwrite existing content, surprise the user, and normalize unannounced workspace writes.

Missing User Warnings

Low
Confidence
91% confidence
Finding
The workflow instructs the agent to generate `work-resource.md` in the project root after asking the user questions, but it still lacks a clear warning or consent checkpoint at the moment of file creation. In context this file is part of the thesis workflow, so the risk is limited, but unannounced generation of new files can clutter the workspace or create unexpected artifacts from sensitive user inputs.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.