ClawHub
Back to skill

Security audit

NoahAI medical conference query

Security checks across malware telemetry and agentic risk

Overview

This is a coherent NoahAI medical-conference search skill, with expected API-token and network use but some privacy-relevant logging users should know about.

Install only if you trust noah.bio with your medical conference search terms and can provide a NOAH_API_TOKEN safely. Avoid using it for confidential research topics in shared or hosted agent environments unless you are comfortable with the query payload appearing in execution logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
76% confidence
Finding
The trigger guidance is broad enough that the skill may activate for generic conference-related queries, causing unnecessary access to the NOAH_API_TOKEN-backed network capability and possible unintended data retrieval. In context this is less severe because the skill's purpose is legitimately conference search, but overbroad invocation still increases attack surface and the chance of surprising tool use.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script logs the full query payload to stderr before transmitting it, and those payloads may contain sensitive research topics, drug interests, institutions, diseases, or other user-supplied terms. In many agent, CI, or hosted execution environments, stderr is centrally collected, retained, and visible to operators, creating an unnecessary secondary disclosure channel beyond the intended API request.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.