ClawHub
Back to skill

Security audit

Claims Processing Automation

Security checks across malware telemetry and agentic risk

Overview

This is a text-only claims automation playbook, but it recommends agent-driven adjudication and payment handling without enough privacy, approval, or oversight boundaries.

Review before installing for real claims operations. Treat it as an advisory checklist only unless you add human review, role-based access, audit logging, data minimization, privacy controls, jurisdiction-specific compliance review, and explicit approval gates for denials, fraud flags, holds, and payments.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The quick-start instruction tells users to 'install this skill and ask your agent to run a claims audit' without defining scope limits, approval requirements, data handling constraints, or appropriate environments. In a claims-processing context, that broad invocation can cause the agent to operate on sensitive financial or health-related claim data and influence triage or payment decisions without adequate human review.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README promotes automation of fraud screening, adjudication, and payment authorization but provides no warning about the sensitivity of personal, medical, or financial data or the risks of automated decision-making. In this domain, missing safeguards can lead to privacy violations, wrongful denials, improper payments, and compliance failures if users deploy the skill as decision authority rather than decision support.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill promotes automated fraud screening, adjudication, and payment decisions in claims workflows without any safeguards around handling sensitive insurance, financial, or health-related data, or around human review for outcome-affecting decisions. In this context, omission of privacy, access control, auditability, and decision-governance guidance is dangerous because these workflows can directly expose regulated data and cause wrongful denials, holds, or payments at scale.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The document explicitly recommends high automation levels for intake validation, fraud pre-screening, adjudication, and payment processing, but does not discuss model error, abuse resistance, data privacy, or control boundaries. Because the skill is about claims operations, this omission materially increases risk of unauthorized data processing, automated financial loss, discriminatory or incorrect claim handling, and weak oversight over regulated decisions.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal