Skill Creator Assistant

• Outcome: Pass
• Latest audit: May 29, 2026, 8:32 PM
• Version:
  1.0.0

Overview

This is a Markdown-only helper for creating skill documents, with an optional GitHub upload step that users should review before using.

Safe to install as a documentation helper. Before using the optional GitHub or ClawHub upload, review the generated files, confirm the destination account and public/private visibility, and remove credentials, proprietary prompts, internal workflows, or other sensitive content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly describes creating a GitHub repository and uploading generated skill files, but it does not warn users that this may publish contents to an external service or expose sensitive prompts, configurations, or proprietary workflow details. In a skill-generation context aimed at non-technical users, this omission increases the likelihood of accidental public disclosure because users may not understand GitHub visibility defaults or the implications of publishing generated artifacts.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The conversation flow asks when and why a skill should trigger, but provides no guardrails for specificity, scope limits, or negative conditions. In a skill-generation assistant, vague trigger guidance can cause users to create overly broad activation rules that invoke powerful behaviors unexpectedly, increasing the chance of accidental data access, unsafe automation, or misuse in unrelated contexts.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The generated template leaves the Triggers section as a generic placeholder, which encourages downstream skills to ship with underspecified activation logic. Because this assistant is intended to produce ready-to-use SKILL.md files, the omission propagates insecure defaults into newly created skills and can make them activate far beyond the author's intent.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill advertises optional GitHub and ClawHub upload capability without any visible warning that uploading may create a public repository or disclose the generated content. In a tool aimed at non-technical users, this omission materially increases the risk of users publishing sensitive prompts, internal workflows, credentials, or proprietary data by mistake.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The GitHub upload workflow lists repository creation and file upload steps as straightforward actions but omits any notice about visibility, permanence, or publication of potentially sensitive content. This is especially risky in a skill generator, where outputs may contain operational details, internal automation logic, or embedded secrets that users do not realize should be reviewed before publishing.

VirusTotal

65/65 vendors flagged this skill as clean.