ClawHub
Back to skill

Security audit

胡来给你算一卦

Security checks across malware telemetry and agentic risk

Overview

This is a light entertainment fortune-telling skill with static content and no sensitive permissions, code execution, network access, or persistence.

Install only if you want casual Chinese-language fortune-style entertainment. Be aware it may activate on broad phrases like “今日运势” or “测一测,” and treat all results as jokes rather than advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list includes very generic phrases such as “今日运势”, “测一测”, and divination-related terms that can plausibly appear in ordinary conversation, increasing the chance this skill activates when the user did not explicitly intend to invoke it. Unintended invocation can hijack responses, interfere with other skills, and degrade reliability, especially because the skill is designed to take over conversational output with a fixed formatted response.

Vague Triggers

Low
Confidence
88% confidence
Finding
The scenario entry phrases like “算算外卖”, “算算快递”, and similar short commands are somewhat ambiguous and may overlap with normal user phrasing about those topics. Because the skill instructs the agent to always show clickable examples and a scenario table, accidental matches could redirect ordinary utility conversations into entertainment output and create unwanted behavior, though the impact is limited by the non-sensitive nature of the skill.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.