ClawHub
Back to skill

Security audit

Design Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

This skill locally remembers design preferences for future design work; the behavior is disclosed and purpose-aligned, but users should understand it creates or updates a local preference file.

Install only if you want the agent to remember and reuse your UI or graphic design preferences. Review ~/.design-preferences/profile.md periodically, and avoid running the initialization snippet if you already have a profile file you want to keep.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger condition is broad enough that ordinary design conversations could invoke the skill unintentionally. Because the skill is allowed to use exec and includes file-writing workflows, unintended activation could lead to silent local state creation or modification without the user clearly requesting persistent tracking.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The capability coverage is declared through a long keyword list without strict trigger constraints or negative conditions. In an agent environment, this increases the risk of overmatching user prompts and causing the skill to activate in contexts where the user did not intend local preference tracking or file operations.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill states it will automatically observe user choices and write preferences to a local file, but it does not require clear disclosure or consent at the point of collection and persistence. This creates a privacy and transparency risk because ongoing behavioral profiling and local storage may occur without sufficiently explicit user awareness.

Missing User Warnings

Low
Confidence
78% confidence
Finding
The example performs local directory creation and writes a profile file but does not place a clear warning adjacent to those commands about filesystem impact. While the actions are limited and local, the omission can still mislead users into authorizing persistent changes without understanding that files will be created or overwritten.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.