ClawHub
Back to skill

Security audit

Chief Creative Officer Free

Security checks across malware telemetry and agentic risk

Overview

This looks like a creative-planning text assistant, but it requests command execution and file-reading access without showing why those powers are needed.

Review this before installing because it appears to perform only creative text generation, yet asks for read and exec tool access. If you use it, prefer running it in a constrained environment or remove exec/read unless you have a specific, trusted reason for those capabilities.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger description is broad enough to activate on many ordinary creative-help requests, which can cause the skill to be invoked without clear user intent or task boundaries. Overbroad activation increases the chance that the agent applies this skill inappropriately, including in contexts where its guidance, tool access, or embedded assumptions are not relevant.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The usage section relies on generic natural-language prompts without explicit invocation constraints, making accidental or overly permissive activation likely. In combination with declared tool availability including exec, this broad matching surface is more concerning because ordinary user requests could route into a skill that appears operationally capable beyond simple text generation.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.