ClawHub
Back to skill

Security audit

Apple HigDesign Skill

Security checks across malware telemetry and agentic risk

Overview

This is a read-only Apple design reference skill with minor routing and formatting rough edges, but no evidence of hidden execution or data access.

Reasonable to install if you want Apple HIG-style design help. Expect it may sometimes trigger on broad Apple platform mentions, and verify current Apple design details against official Apple documentation when accuracy matters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list contains broad terms like "Apple平台", "watchOS", and general Apple design phrases that can match ordinary conversation outside the intended Apple HIG design-assistance context. This can cause unintended activation, leading the agent to inject irrelevant guidance or override a more appropriate skill, which is a real prompt-scope and routing risk even though it is not directly code-execution related.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The skill prescribes a fixed Chinese-only response structure without offering language negotiation or respecting the user's language, which can cause the system to respond in an unintended language and reduce usability or clarity. In a multi-skill environment, this also creates instruction-precedence friction because the skill may steer output formatting and language even when the user's request is in another language.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.