ClawHub
Back to skill

Security audit

Thesis Topic Selector

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only academic brainstorming skill; its scope is broad, but it does not request code execution, credentials, file access, or background behavior.

Safe to install for academic topic brainstorming. Users should treat generated topics and literature suggestions as starting points, verify sources and originality independently, and be aware that the skill may activate for broad research-idea requests.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill description says it should be used whenever a user needs topic selection, research directions, innovative angles, or exploration of non-trivial topics in any discipline. That scope is extremely broad and can cause the agent to invoke the skill for many ordinary brainstorming or help-seeking requests, reducing routing precision and potentially overriding more appropriate, narrower skills. In context, this is not direct code-execution risk, but it is a real security/control issue because over-broad triggering expands the skill's authority surface across many domains.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The invocation examples include broad phrases like asking for topic ideas in a field, which are common formulations that overlap with everyday assistance and general ideation. Without explicit scope boundaries or negative examples, these examples train or encourage the agent to match the skill too aggressively, increasing unintended invocation and the chance that academic-style outputs are produced when a more suitable skill should handle the request. The surrounding skill context makes this somewhat more concerning because the skill claims applicability to virtually any discipline.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.