ClawHub
Back to skill

Security audit

笔杆子写稿

Security checks across malware telemetry and agentic risk

Overview

This is a simple Chinese drafting skill that only tells the agent how to write formal text and does not include code, tools, credentials, persistence, or hidden behavior.

This appears low risk to install. Use it as a drafting aid, provide only the details needed for the requested document, and review generated text for accuracy, originality, tone, and suitability before publishing or submitting it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill is defined in very broad terms ('generate original content based on user needs') with no domain, safety, or activation boundaries, making it eligible for a wide range of routine writing requests. That over-breadth can cause the agent to inappropriately trigger this skill in contexts where stronger safeguards, user confirmation, or more specialized handling would be needed, increasing misuse and policy-bypass risk.

Natural-Language Policy Violations

Medium
Confidence
79% confidence
Finding
The skill forces a particular output style and register ('formal/fluent', only final body text) without documenting why that restriction is necessary or giving the user a choice. While not directly enabling code execution or data exfiltration, rigid output constraints can suppress clarifying dialogue and make the skill less transparent, which may contribute to misuse or user-intent mismatch.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.