ClawHub
Back to skill

Security audit

Concept Ledger

Security checks across malware telemetry and agentic risk

Overview

This skill is a text-only terminology tracker with disclosed, optional workspace-scoped memory and no evidence of hidden code execution or data export.

Install this if you want an agent to speak up during brainstorming or system design when terminology starts drifting. Keep cross-session memory disabled for sensitive projects unless you explicitly need it, and use the provided session-only, clear, disable, or wipe controls for concepts you do not want retained.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The phrase 'The Agent watches for five common failure modes' describes broad behavioral monitoring but does not specify the exact trigger phrases, contexts, or exclusion conditions for when the skill activates. In a markdown skill card, this can lead to unintended invocation because users and orchestrators are not given clear activation scope or negative examples.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.