ClawHub
Back to skill

Security audit

Claude Says Go To Sleep

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed joke skill that only changes the assistant’s responses, with no evidence of data access, system changes, or hidden execution.

Install only if you intentionally want a novelty skill that may refuse normal tasks and tell you to sleep. Avoid enabling it globally in serious workflows, because ordinary words like stop, quit, or exit could interrupt the session.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The stop-command list includes common words like "stop," "quit," and "exit," which may appear in ordinary user requests unrelated to agent shutdown. This creates a real unintended-activation risk: the skill could terminate or refuse service during normal conversation, making it easy for users or downstream content to disable the agent accidentally.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.