ClawHub
Back to skill

Security audit

Visual Storyteller

Security checks across malware telemetry and agentic risk

Overview

This is a visual storytelling instruction skill with no install steps, executables, network behavior, or hidden privileged actions.

Reasonable to install for visual storytelling help. Use it in workspaces where project brand, audience, and visual asset files are appropriate for the agent to inspect when you ask for that kind of creative strategy work.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The activation guidance says to reference the agent by name or specialty when its expertise is needed, but it does not define specific trigger phrases, scope boundaries, or exclusion conditions. Terms like "specialty" and "need its expertise" are broad enough to overlap with ordinary conversation about storytelling or visuals, increasing the risk of unintended invocation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.