ClawHub

Meerkat Governance

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed third-party AI governance API skill, but users should be careful about what content they send to the external service.

Install only if you are comfortable sending selected content to Meerkat's external API. Avoid submitting secrets, credentials, regulated records, or full proprietary documents unless your organization has approved the service's privacy, retention, access-control, and compliance terms.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The skill makes conflicting privacy and retention claims: it says content is processed in memory and discarded with no raw content retained, but later says content is not stored beyond an audit trail retention period. This can mislead integrators into sending sensitive data under false assumptions, increasing privacy, compliance, and data-governance risk.

External Transmission

Medium
Category
Data Exfiltration
Content
The `/v1/shield` endpoint scans content for prompt injection, jailbreaks, data exfiltration, and social engineering. The agent can call this before processing content the developer designates as untrusted. Common examples include external emails, web-scraped content, and user-uploaded documents. Developers can optionally configure their agent to shield skill descriptions before installation.

```bash
curl -s -X POST https://api.meerkatplatform.com/v1/shield \
  -H "Authorization: Bearer $MEERKAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"input\": \"<THE_CONTENT>\"}"
Confidence
92% confidence
Finding
curl -s -X POST https://api.meerkatplatform.com/v1/shield \ -H "Authorization: Bearer $MEERKAT_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"input\": \"<THE_CONTENT>\"}" ``` **Respons

External Transmission

Medium
Category
Data Exfiltration
Content
The `/v1/shield` endpoint scans content for prompt injection, jailbreaks, data exfiltration, and social engineering. The agent can call this before processing content the developer designates as untrusted. Common examples include external emails, web-scraped content, and user-uploaded documents. Developers can optionally configure their agent to shield skill descriptions before installation.

```bash
curl -s -X POST https://api.meerkatplatform.com/v1/shield \
  -H "Authorization: Bearer $MEERKAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"input\": \"<THE_CONTENT>\"}"
Confidence
92% confidence
Finding
https://api.meerkatplatform.com/

External Transmission

Medium
Category
Data Exfiltration
Content
The `/v1/verify` endpoint checks AI-generated output against source data using up to five ML checks: entailment (DeBERTa NLI), numerical verification, semantic entropy, implicit preference detection, and claim extraction.

```bash
curl -s -X POST https://api.meerkatplatform.com/v1/verify \
  -H "Authorization: Bearer $MEERKAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"input\": \"<USER_REQUEST>\", \"output\": \"<AI_OUTPUT>\", \"context\": \"<SOURCE_DATA>\", \"domain\": \"<DOMAIN>\"}"
Confidence
95% confidence
Finding
https://api.meerkatplatform.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Every shield and verify call is logged with an audit ID. The `/v1/audit/<audit_id>` endpoint retrieves the full record. Add `?include_session=true` to see all linked attempts in a retry session.

```bash
curl -s https://api.meerkatplatform.com/v1/audit/<audit_id> \
  -H "Authorization: Bearer $MEERKAT_API_KEY"
```
Confidence
84% confidence
Finding
https://api.meerkatplatform.com/

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal