ClawHub
Back to skill

Security audit

Chat Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a local communication-preference manager, but its requested command/write authority and unrelated trigger instructions are broader than its stated purpose.

Review this before installing because it requests command execution even though its own documentation says it is pure Markdown. If you use it, keep it limited to explicit communication-preference tasks, review ~/chat-toolkit periodically, and avoid storing sensitive personal or workplace information in preference files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill claims it is a pure Markdown skill that does not require exec capability, but the manifest grants exec and earlier examples explicitly invoke shell commands. This mismatch can mislead reviewers and users about the true privilege level of the skill, increasing the chance that command execution is available when not expected.

Intent-Code Divergence

Medium
Confidence
82% confidence
Finding
The document says preference data is fully local and does not involve cloud calls, yet it also lists an LLM API as a required dependency. Even if only metadata or prompts are sent, this creates a data handling transparency issue and may cause users to expose preference data under false assumptions about locality.

Vague Triggers

High
Confidence
88% confidence
Finding
The trigger conditions are clearly unrelated to the skill's actual purpose, making activation criteria ambiguous and prone to misfire. In an agent environment, broad or incorrect triggers can cause the skill to run in unrelated contexts, leading to unintended file reads/writes or preference manipulation without meaningful user intent.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs creation and maintenance of local files containing user preferences, including rejected and confirmed behaviors, but does not present a clear warning that user data will be written to disk. This can lead to silent persistence of potentially sensitive personal preference data, especially on shared systems or synced home directories.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.