ClawHub
Back to skill

Security audit

Ted English Learning

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward TED-study note generator that creates local learning files, with no evidence of credential access, hidden data collection, or destructive behavior.

Install this only if you want a skill that creates and updates files under your current working directory. Use it from a dedicated study-notes folder or check the target paths first, especially because it updates English/English.md and writes files under English/TED.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The skill description says it should be used whenever the user mentions TED talks, English learning, speech analysis, or TED transcript parsing, which is broad enough to overlap with many normal conversations. This can cause unintended activation and execution of file-writing workflows or local tooling in contexts where the user did not explicitly request this skill, increasing the chance of surprising actions and unsafe handling of local content.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill instructs the agent to write Markdown, Canvas, and index files under the user's working directory, but it does not clearly warn the user up front that local files will be created and modified. In practice, this can lead to silent changes in user repositories or notes, including overwriting existing files or altering index content without informed consent.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.