ClawHub
Back to skill

Security audit

Game Dev GDD

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Game Design Document writing template, with minor usability caveats around broad triggers and file creation.

Install is reasonable if you want guided GDD generation. Before running it, confirm that the request is game-related and tell the agent where to place the generated Markdown files, especially if your workspace already has a gdd/ folder or design documents.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrase "design document" is overly generic and can match many non-game requests, causing the skill to activate outside its intended scope. That can lead to inappropriate file-creation behavior or irrelevant prompting in unrelated contexts, increasing the chance of unintended workspace modifications or user confusion.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs the agent to create a `gdd/` folder and multiple markdown files without clearly warning the user beforehand that workspace files will be written. In agent environments with write access, this can cause unexpected filesystem changes, clutter repositories, or overwrite existing planning documents if paths collide.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal