ClawHub
Back to skill

Security audit

Core Vocabulary for CET-4

Security checks across malware telemetry and agentic risk

Overview

This is a simple CET-4 vocabulary skill that reads a bundled word list and returns random study entries, with no evidence of hidden execution, data exfiltration, or persistence.

Safe to install for CET-4 vocabulary practice. Be aware that it declares shell access even though the visible behavior only needs local word-list reading; prefer a future version that removes or narrows that requirement if your environment treats shell access as sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill declares a shell/bin requirement even though its stated purpose is only to read and return random entries from a local vocabulary file. Unnecessary shell access expands the attack surface and could enable command execution or abuse of host capabilities if the runtime grants that permission.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The invocation description is broad enough that the skill may activate on loosely related user requests without clear constraints. Overbroad triggering can cause unintended file access or unexpected behavior, especially when combined with unnecessary shell capability.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.