ClawHub
Back to skill

Security audit

Gdpr Checker

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent local GDPR audit checklist, but it includes live financial-data mutation and plaintext export steps without enough containment or warning.

Install only if you understand it is meant for a local ZK-Bankir audit and review each command before running it. Run the mutation checks only on a disposable copy, staging database, or inside an explicit rollback transaction, and handle any GDPR export as sensitive financial data: write it to a protected location, keep permissions restrictive, avoid committing or syncing it, and delete or encrypt it after use.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill generates a complete JSON export of user financial data and writes it to disk in the current working directory without requiring confirmation, restricting permissions, or warning about the sensitivity of the resulting file. Even in a local-only GDPR audit context, this creates a realistic confidentiality risk because the export may be left behind, copied into backups, indexed by other tools, or exposed through permissive filesystem access.

Static analysis

No suspicious patterns detected.