ClawHub
Back to skill

Security audit

Xiao Chuang You Photography

Security checks across malware telemetry and agentic risk

Overview

This is a simple Chinese photography guidance skill with broad trigger words, but no evidence of harmful behavior or sensitive access.

Install is reasonable if you want Chinese-language photography coaching. Expect that it may activate on broad camera or photo-related mentions, so remove or narrow it if that interferes with other skills.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill description says it should activate for broad, common photography-related topics, which increases the chance of unintended routing on casual mentions rather than explicit requests for this skill. While this is not directly exploitable as code execution, over-broad activation can cause misrouting, unexpected behavior, and interference with more appropriate skills.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger list is composed of generic single-word terms like '摄影', '拍照', and '相机', which are likely to appear in many unrelated conversations. This can make the skill activate too often, causing prompt hijacking of benign queries and reducing reliability of skill selection across the system.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.