ClawHub
Back to skill

Security audit

Zhihu Topic Hunter

Security checks across malware telemetry and agentic risk

Overview

This is a content-planning skill for generating Zhihu topic ideas, with no executable code, persistence, credential use, or hidden high-impact behavior.

Installers should understand that this skill is narrowly useful for Zhihu content planning. If you want outputs in another language or for another platform, give that instruction explicitly; for hot or recent topics, make sure browsing is available or provide source material yourself.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The skill description includes broad activation phrases such as use when the user asks for 知乎选题, topic hunting for Zhihu, recent discussion angles, or platform-specific topic ideas around a theme, which creates ambiguous invocation boundaries. This can cause the skill to activate in loosely related content-ideation contexts and override or steer responses unexpectedly, increasing prompt-scope and routing risk even though the skill itself is not overtly malicious.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
The mandated output structure is entirely in Chinese and does not provide a user-language fallback or opt-in mechanism. This can cause the system to ignore the user's preferred language and produce unusable or confusing output, which is a policy/UX control weakness that may indirectly interfere with higher-priority user instructions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.