ClawHub
Back to skill

Security audit

AI Workflow Automation Expert

Security checks across malware telemetry and agentic risk

Overview

This is a Markdown-only workflow automation guide with broad examples, but it does not install code, access accounts, or run automations itself.

Install only if you want broad workflow-design help. Before turning its templates into real automations, review each connected skill separately, keep scheduled jobs narrowly scoped, avoid storing secrets in memory, and require manual approval for outbound emails, public posts, customer-facing responses, financial actions, or workflows using sensitive data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill metadata advertises very broad trigger phrases around generic automation topics, making accidental or inappropriate invocation likely. In an agent ecosystem, this can cause the skill to activate for common user requests and steer execution toward automation design, including external integrations and autonomous workflows, without clear scoping or safety gating.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The invocation examples are open-ended and match ordinary requests like 'help me automate' or 'design a workflow,' which are common across many benign tasks. This ambiguity increases the chance of over-triggering and can route users into guidance for automation pipelines that may touch external systems, data sources, or publishing actions without sufficient context checks.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The templates describe workflows that query data sources, send email, process support inquiries, and schedule social posts, but they do not warn about handling sensitive data, consent, authorization, or downstream privacy risks. In practice, users may copy these patterns into production and automate communications or data processing in ways that expose confidential information or perform unintended external actions.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.