ClawHub
Back to skill

Security audit

zayn-ai-task-diagnosis

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Chinese-language task-diagnosis guide that helps users decide when AI, automation, programs, templates, or humans should handle work, with repeated emphasis on human review for high-risk actions.

Install this if you want a Chinese-language framework for deciding how much AI or automation a task should use. Before applying it to sales, HR, finance, legal, security, public posting, deletion, or customer-facing work, keep the human approval points it requires and confirm applicable compliance rules.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The default invocation prompt is very broad and can be applied to nearly any user request about creating a tool, workflow, automation, or assistant. Without trigger scope constraints, the skill may be invoked in unintended contexts, causing over-collection of user task details, unnecessary routing into this skill, or interference with more appropriate safety or domain-specific handling.

Natural-Language Policy Violations

Medium
Confidence
78% confidence
Finding
The skill metadata and default prompt force Chinese-language interaction, but there is no documented user preference or opt-in for that language. This can mislead users, reduce comprehension of the skill's output, and create consent and usability problems, especially if users expect analysis in another language.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The example explicitly describes collecting procurement decision-makers' email addresses and contacting them, which involves handling personal contact data and potential outbound outreach. Although it mentions privacy and compliance risk, it does not give an explicit warning or concrete safeguards for lawful basis, consent, source validation, jurisdictional rules, or anti-spam requirements, so users could operationalize lead collection in a non-compliant way.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.