ClawHub
Back to skill

Security audit

Prompt Engineering Expert

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only prompt engineering skill with one unsafe refusal-troubleshooting example, but no code, credentials, persistence, hidden access, or data movement.

Reasonable to install as a prompt engineering reference. Before using it in safety-sensitive environments, revise or ignore the refusal-troubleshooting example and do not use fictional, academic, or professional framing to bypass legitimate model safety refusals.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The guide explicitly recommends reframing a refused harmful request into a fictional or academic context to elicit discussion of manipulation tactics. That is a known prompt-bypass pattern because it helps users obtain assistance on socially harmful behavior under a thin legitimacy pretext, especially in a prompt-engineering skill where readers are learning how to improve model compliance.

Ssd 1

Medium
Confidence
96% confidence
Finding
Suggesting fictional framing as a workaround for refusals directly teaches users how to bypass safety controls rather than how to reformulate toward benign goals. In the context of a prompt-engineering expert skill, this is more dangerous because the document is positioned as operational advice for making models comply, so the bypass technique is likely to be reused on other restricted topics.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.