ClawHub
Back to skill

Security audit

福彩筛选

Security checks across malware telemetry and agentic risk

Overview

This lottery-analysis skill is transparent about its web data lookup, local caching, and chart generation, with minor routing caveats but no hidden or destructive behavior found.

Before installing, be aware that generic Chinese terms like filtering, trend, or results may invoke the skill in the wrong context, and ambiguous lottery names should be confirmed. Verify official lottery results independently and do not rely on generated recommendations as a guarantee or financial strategy.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger keywords are very broad, including common terms like '过滤', '走势', and '开奖结果', which can cause the skill to activate in unrelated conversations. Over-broad invocation increases the chance of unintended tool use, file access, or network-backed data retrieval in contexts where the user did not actually ask for lottery analysis, creating a prompt-routing and scope-control weakness.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The automatic game-identification rules are ambiguous and include corrections like mapping '大乐透' to 双色球 and '29选7' to 七乐彩, which can misclassify user intent and cause the wrong workflow, data source, or output format to be used. In an agent setting, ambiguous routing is dangerous because it can trigger actions under false assumptions and reduce user control over what the system does.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.