ClawHub
Back to skill

Security audit

企业级智能客服知识库构建器

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a straightforward knowledge-base builder, but users should sanitize business documents and chat logs before using it.

Install only if you are comfortable giving the agent runtime the documents you provide as input. Redact personal data, credentials, regulated records, and confidential customer details from product documents or chat logs before use, and manually review generated knowledge-base content before publishing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The README explicitly encourages uploading product documents, FAQs, and historical conversations, which commonly contain personal data, confidential business information, and customer support records. Without any privacy warning, data-handling expectations, redaction guidance, or retention/security disclosures, users may submit sensitive material inappropriately, increasing the risk of privacy violations or unauthorized processing.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly encourages uploading product documents, FAQs, and historical conversations, which commonly contain personal data, confidential business information, credentials, or regulated content. Because the skill text does not warn about data minimization, consent, redaction, retention, or access controls, it increases the risk that sensitive information will be ingested into the knowledge base and later exposed through generated outputs or downstream support workflows.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The manifest explicitly invites users to upload product documents, FAQs, and historical chat logs, which commonly contain personal data, confidential business information, or regulated content. Because the metadata provides no privacy notice, data-handling constraints, consent requirements, or redaction guidance, users may submit sensitive material without understanding the risk, increasing the chance of privacy violations or unauthorized disclosure.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.