ClawHub
Back to skill

Security audit

电商CPS社群文案生成助手

Security checks across malware telemetry and agentic risk

Overview

This text-only marketing skill has no code or device access, but it explicitly helps create staged group-chat promotions with planted participants and fake social proof.

Install only if you will use it for transparent promotional drafting. Do not use the staged group-chat mode to fabricate customer reactions, purchases, testimonials, stock pressure, or undisclosed endorsements; verify product claims, prices, availability, and affiliate/sponsored disclosures before publishing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

High
Confidence
98% confidence
Finding
The skill explicitly instructs the model to generate scripts using fake supporting participants ('托'), simulated user reactions, and staged testimonials to create the appearance of authentic group consensus. This is deceptive social-engineering content that can mislead users into trusting fabricated endorsements and artificially induced purchase pressure.

Ssd 4

Medium
Confidence
96% confidence
Finding
The multi-stage '群主+托' script is designed to simulate organic group conversation, progressively build trust, answer objections through planted prompts, and apply urgency tactics to push conversion. In the context of a marketing skill, this increases danger because the deceptive structure is not incidental—it is the core workflow, making manipulative persuasion scalable and repeatable.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal