ClawHub
Back to skill

Security audit

youclaw

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed YouCloud marketing-analysis API integration, with the main caution that user prompts may be sent to an external service when triggered.

Install only if you intend to use YouCloud's service and are comfortable sending brand, campaign, and follow-up context to that external API. Use a scoped YOUCLOUD_API_KEY you can rotate, and prefer explicit slash commands when the content is sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger keywords are broad conversational phrases, which increases the chance of accidental invocation during unrelated chats. In an agent environment, unintended activation can cause unsolicited external API calls, unexpected data disclosure to a third party, and confusing mode changes without clear user intent.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The mode-selection logic relies on vague natural-language cues like '内容简短' or '明确要讨论', which makes routing unpredictable. That ambiguity can lead to the wrong processing mode, accidental reuse of conversational context, or sending content to the remote service under assumptions the user did not intend.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.