ClawHub

优化用户提示词（超过50字自动激活）

Security checks across malware telemetry and agentic risk

Overview

This prompt-optimization skill appears intended to improve prompts, but it is too broad because it can automatically rewrite and execute many ordinary user requests without clear opt-in.

Install only if you want a global prompt-optimizer that may rewrite ordinary requests before they run. Prefer using it manually for drafting or improving prompts, and review optimized prompts before allowing the agent to execute them, especially for coding, account, financial, or other high-impact tasks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

High
Confidence
94% confidence
Finding
The skill is configured to auto-activate on any user prompt over 50 characters and on broad categories like research, complexity, or ambiguity, without clear scoping or opt-in. This can cause the system to rewrite user intent and proceed automatically, creating prompt-injection-like control flow issues, unexpected behavior, and reduced user agency even in benign conversations.

Vague Triggers

High
Confidence
96% confidence
Finding
The execution flow mandates automatic optimization followed by immediate task execution, but does not define robust boundaries for when the optimizer must abstain. In a multi-skill or instruction-sensitive environment, this broad interception layer can unexpectedly override normal routing, alter task semantics, or amplify mistakes before the user can correct them.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal