ClawHub
Back to skill

Security audit

Clinical Data Cleaner

Security checks across malware telemetry and agentic risk

Overview

This skill is a local clinical data cleaning tool whose file access and outputs fit its stated purpose, with dependency and validation cautions but no evidence of hidden or malicious behavior.

Install only in an environment appropriate for sensitive clinical data. Confirm the input file, output path, and cleaning options before running, avoid overwriting raw datasets, review the generated audit report, and pin vetted versions of numpy, pandas, and scipy for any regulated or repeatable workflow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documentation advertises executable workflows that read input files and write cleaned datasets and audit reports, but it does not declare corresponding permissions. In an agent environment, this creates a trust and policy gap: operators may approve or route the skill under the assumption that it has no file-system effects, while the packaged code is expected to access and modify local data.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
pandas
scipy
Confidence
97% confidence
Finding
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
pandas
scipy
Confidence
97% confidence
Finding
pandas

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
pandas
scipy
Confidence
97% confidence
Finding
scipy

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
87% confidence
Finding
numpy

Known Vulnerable Dependency: pandas — 1 advisory(ies): CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)

High
Category
Supply Chain
Confidence
79% confidence
Finding
pandas

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
90% confidence
Finding
scipy

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.