ClawHub
Back to skill

Security audit

Skill Creator

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a normal guide for creating skills, but it tells agents to run helper scripts that are not included in the package.

Review before installing. The content is not malicious on its face, but do not let an agent run the listed script commands unless you have confirmed exactly which init_skill.py and package_skill.py files will execute and that they are from the intended skill tooling, not an unrelated project directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The guidance says the description is the 'primary triggering mechanism' and encourages including all possible 'when to use' information, but it does not require clear boundaries or exclusions. That can cause a skill to activate too broadly, pulling in unnecessary instructions or tool workflows in unrelated contexts, which increases the chance of unintended actions and prompt-scope interference.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.