ClawHub
Back to skill

Security audit

Internship Review

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed internship reflection assistant that uses relevant user-provided notes and writes a review template to a user-specified location.

Before installing, be selective about any diary, work log, or Obsidian notes you share, especially if they include employer-confidential or personal material. When asking it to create a file, specify the exact destination and avoid overwriting existing notes unless you intend to.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to write generated content into user-controlled destinations such as an Obsidian vault or local files without explicitly requiring confirmation immediately before the write. This can lead to unintended file modification, overwriting notes, or persistence of sensitive content in places the user did not fully expect, especially when combined with broad triggering or ambiguous destination selection.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill proactively asks to read internship diaries or notes from Obsidian or similar systems because they are a rich source of material, but it does so without any privacy warning, scope limitation, or minimization guidance. Personal journals and work notes often contain sensitive employer information, private reflections, or unrelated personal data, so encouraging proactive access increases the risk of over-collection and exposure.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.