ClawHub
Back to skill

Security audit

Game Dev Tool Free

Security checks across malware telemetry and agentic risk

Overview

This game-development guide is not malicious, but it asks for broad file-write and command-execution capability without clear safety boundaries.

Install only if you are comfortable with an agent using this skill to modify project files and potentially run development commands. Keep use confined to a game project workspace, review proposed file changes, and require confirmation before any shell command, build, deployment, or broad file operation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill is described as a Markdown/LLM guidance tool, yet it declares exec capability alongside read/write. That unnecessarily expands the attack surface: a prompt-injected or mis-triggered workflow could execute shell commands on the host despite the skill's documented purpose not requiring code execution.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The trigger condition is overly broad, covering code generation, programming assistance, debugging, testing, and deployment. In a skill that also exposes write/exec, broad matching raises the chance of accidental invocation in contexts where the agent may modify files or run commands without the user intending to use this specific skill.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill declares write/exec plus export/save/modify operations but provides no explicit warning, consent model, or safety boundaries for those side effects. In practice, this can enable silent file changes or command execution if the skill is triggered by ambiguous requests or prompt-injected content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.