ClawHub
Back to skill

Security audit

Survival Analysis (KM)

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local survival-analysis tool, but users should handle clinical data and output paths carefully.

Install in an isolated Python environment, use de-identified or authorized datasets only, and write outputs to a dedicated workspace folder. Review generated plots, CSVs, and reports before sharing because they may reveal sensitive clinical information or derived statistics.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger description is broad enough to activate on generic requests about survival analysis or biomedical statistics without clearly constraining when this skill should run. In a clinical/biomedical context, overbroad activation increases the chance the tool is invoked on sensitive health-related data or in situations where users did not explicitly intend to run a local script, which can lead to inappropriate data handling or unsafe automation.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This skill operates on clinical and biological survival datasets, which commonly contain protected or sensitive patient information, yet the description does not warn users about privacy, de-identification, or secure handling expectations. That omission makes accidental exposure more likely through unsafe input selection, saved output files, or downstream sharing of generated reports and plots.

Unpinned Dependencies

Low
Category
Supply Chain
Content
lifelines
matplotlib
numpy
pandas
Confidence
95% confidence
Finding
The dependency list leaves lifelines unpinned, which makes builds non-reproducible and can cause the skill to install newly released versions with breaking changes or newly introduced supply-chain risk. While this does not prove an exploitable flaw by itself, unpinned dependencies are a real security weakness because they reduce control over what code is executed at install time.

Unpinned Dependencies

Low
Category
Supply Chain
Content
lifelines
matplotlib
numpy
pandas
seaborn
Confidence
95% confidence
Finding
matplotlib is unpinned, so installations may pull different versions over time, undermining reproducibility and increasing exposure to accidental adoption of vulnerable or malicious upstream releases. This is generally a supply-chain hygiene issue rather than an immediately exploitable bug in the file itself.

Unpinned Dependencies

Low
Category
Supply Chain
Content
lifelines
matplotlib
numpy
pandas
seaborn
Confidence
98% confidence
Finding
numpy is unpinned, which is more concerning because static analysis also flags known advisories affecting some numpy versions. Without a version constraint, the environment may resolve to vulnerable releases or other unintended versions, increasing supply-chain and patch-management risk.

Unpinned Dependencies

Low
Category
Supply Chain
Content
lifelines
matplotlib
numpy
pandas
seaborn
Confidence
98% confidence
Finding
pandas is unpinned, and this matters more because there is also an advisory associated with certain pandas releases. Leaving it unconstrained means deployments may inadvertently select outdated or vulnerable versions, especially across different environments.

Unpinned Dependencies

Low
Category
Supply Chain
Content
matplotlib
numpy
pandas
seaborn
Confidence
95% confidence
Finding
seaborn is unpinned, creating the same reproducibility and supply-chain exposure issues as the other dependencies. This is a genuine dependency hygiene weakness, though the direct exploitability from this file alone is limited.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.