ClawHub

fanqie-masterclass

Security checks across malware telemetry and agentic risk

Overview

This is a Markdown-only Chinese fiction-writing course with disclosed, purpose-aligned references to writing platforms and AI tools.

Reasonable to install for Fanqie-style fiction coaching. Review content before pasting it into external AI or publishing platforms, and independently verify copyright, tax, payment, and platform-policy advice before acting on it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill’s trigger phrases are broad enough to match common, generic writing-help requests like learning, generating, diagnosing, or polishing text. In an agent routing context, this can cause the skill to activate outside its intended niche, leading to unintended instruction takeover, incorrect tool selection, or response shaping that the user did not ask for.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
The skill metadata and operating instructions are written as Chinese-only without offering a user language choice or documenting that the skill is intentionally restricted to Chinese users. This can create unsafe UX and routing behavior where non-Chinese users receive inaccessible or misinterpreted guidance, increasing the chance of misunderstanding rather than direct security compromise.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal