ClawHub
Back to skill

Security audit

Self-Guardian

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only safety skill that adds extra caution around file edits and shell commands, with some likely over-triggering and a privacy caveat to watch for.

Install this if you want a cautious agent that asks more often before file edits, deletions, database changes, or risky commands. Expect extra prompts on normal refactors or cleanup work, and avoid letting it copy secrets, keys, databases, or private files into chat history; use git checkpoints or local backups for sensitive material.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation keywords are very broad and include common terms like 'write file', 'execute', 'refactor', and 'clean up', which can cause the skill to trigger on many ordinary requests. Because this skill imposes behavioral constraints on file and shell operations, over-triggering can create ambiguous scope, unexpected interceptions, and prompt-surface expansion where unrelated requests are treated as risky operations.

Vague Triggers

Medium
Confidence
85% confidence
Finding
Saying the skill 'activates automatically on file/shell operations' is ambiguous because it does not clearly define what operations, contexts, or tool invocations count. In a security-sensitive skill, unclear activation scope can lead to inconsistent enforcement, accidental triggering, or bypasses if agents interpret the boundary differently.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.