ClawHub
Back to skill

Security audit

plaud-recordings-to-google-drive-sync

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it syncs Plaud recordings and transcripts into the user's Google Drive and Google Sheet, with privacy implications the user should understand.

Install only if you want all Plaud recordings found by the workflow, plus transcript JSON and metadata, copied into your Google Drive and Google Sheets. Review the sharing and retention settings on those Google assets, and be aware that recordings without Plaud transcripts may be processed through the speech-to-text service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill performs broad cross-service replication of sensitive user content—audio recordings, transcripts, metadata, and inferred recording purpose—into Google Drive and Google Sheets, but the description does not prominently warn that all Plaud recordings may be copied out of the source platform. That omission can cause users to invoke the workflow without understanding the privacy, retention, and access-control implications, increasing the risk of unintended disclosure of highly sensitive conversations.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.