ClawHub

Save Token

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only token-saving guide with broad activation guidance but no executable code, credentials, persistence, or data access.

Install this if you want an agent to reduce repeated context and token usage. For legal, security, debugging, compliance, or other precision-sensitive work, explicitly tell the agent to preserve important details or re-read source material instead of relying only on summaries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The manifest trigger list is broad and generic (for example, token, cost, context, optimize), which can cause the skill to activate in many unrelated conversations. This is not directly exploitable as code execution, but it can create unintended behavior, increase prompt noise, and cause the agent to apply optimization guidance when the user did not want it.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The activation rules are mandatory and expansive, such as '满足任一即应调用' and thresholds like >10 turns or >5000 characters. In practice, this can push the agent to summarize or omit context too aggressively, increasing the risk of losing important information, misinterpreting user intent, or degrading safety-sensitive tasks that depend on full context.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal