ClawHub
Back to skill

Security audit

Blackboard

Security checks across malware telemetry and agentic risk

Overview

This appears to be a low-risk image/poster workflow skill with some usability concerns about when it activates and what language it uses.

Install if you want this specific image/poster workflow. Be explicit about language and style in your prompt, and review any image-generation provider configuration before granting API keys or messaging permissions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrases are broad and overlap with normal user requests for image creation, which can cause the skill to activate when the user did not specifically intend this blackboard-poster workflow. That can misroute requests, force an unintended style, or invoke downstream image generation unexpectedly, reducing user control and potentially causing unwanted tool use.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
The skill strongly constrains output text to Chinese without exposing a user choice for language or locale, which can cause incorrect or unusable outputs for users expecting other languages. In this context the issue is more about policy and usability than direct security compromise, but it can still lead to unintended generation behavior and poor alignment with user intent.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.