ClawHub
Back to skill

Security audit

Diting Performance Expert

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed performance-management guidance skill, with some HR scope-boundary ambiguity around pay, commissions, and PIP/legal-risk topics.

Before installing, treat this skill as a performance-management advisor only. Have a compensation specialist review pay, commission, bonus, or salary-adjustment recommendations, and have a labor-law specialist review PIP, termination, transfer, severance, or dismissal-risk advice before acting on it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill explicitly says labor-law compliance is out of scope, yet the PIP section instructs analysis of legal compliance and exit handling. This boundary conflict can cause the agent to provide quasi-legal HR guidance without proper safeguards, increasing the risk of unsafe employment actions or non-compliant advice.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The boundary states compensation structure and salary-adjustment plans are unsupported, but the skill’s functional scope includes performance-linked promotion/salary adjustment/elimination design. This inconsistency can misroute users into receiving compensation-policy advice from a skill that claims it should defer such matters.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The sales-performance section goes beyond performance management into commission structure, accelerator rates, and deferred payout design, despite the skill declaring compensation topics out of scope. This can lead to unreviewed pay-design recommendations that have financial, legal, and employee-relations consequences.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.