ClawHub
Back to skill

Security audit

Ai Act Risk Check

Security checks across malware telemetry and agentic risk

Overview

This is a narrow AI Act risk checker that sends the description you enter to Gemini for classification, with no evidence of hidden collection, persistence, or destructive behavior.

Install only if you are comfortable with the Gemini CLI processing the AI-system description you provide. Do not submit confidential business details, personal data, or regulated information unless your organization approves that provider and its data-handling terms. Also note the documentation mismatch: it mentions oracle, but the script actually calls gemini.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill documentation states that it uses `oracle` via `exec` for inference, but it does not clearly warn users that their submitted AI system description will be transmitted to an external LLM. This creates a real data disclosure and consent risk because users may provide sensitive business, regulatory, or system-design information under the assumption that processing is local.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.