ClawHub
Back to skill

Security audit

Cuihua Config Validator

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple local configuration validator, but users should avoid handing it live secrets unless they intentionally want those reviewed.

This is reasonable to install for local config checks. Treat .env files, deployment files, and private configs as sensitive: redact production tokens, passwords, API keys, and account details unless you deliberately want the agent to inspect them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The quick-start examples are broad enough that an agent may invoke this skill on loosely related prompts without clear user intent boundaries. Over-broad activation increases the chance of the skill being applied to sensitive files, especially secrets-bearing configuration like .env files, causing unnecessary exposure of private content to the skill pipeline.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.