ClawHub
Back to skill

Security audit

Gdpr Data Export Tool

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent privacy-export guidance, but it also tells agents to perform erasure/deletion workflows that are not clearly scoped in its stated export purpose.

Install only if you want DSAR export design guidance and will keep deletion/erasure operations behind separate legal authorization, identity verification, retention checks, and human approval. Treat the Article 17 deletion portions as requiring extra review before use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

The instruction to 'Always answer both rights with one export by default' biases the workflow toward fulfillment rather than eligibility checks. Because Article 15 and Article 20 have different legal scopes, lawful-basis requirements, and data-category limits, defaulting to both can cause over-disclosure—especially inclusion of portability data or transfer-ready exports when only access rights were requested or when Article 20 does not apply.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
| **Information about processing** | Must be provided (purposes, recipients, retention, source) | Not required (portability is data-focused, not process-focused) |
| **Format constraint** | Readable to a layperson is fine | Must be reusable by another service |

**Practical rule:** Always answer both rights with one export by default. The Article 20 layer is a subset of the Article 15 export. Tag each record with which right covers it.

## Data Inventory Worksheet

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill is centered on collecting, authenticating, packaging, and delivering highly sensitive personal data, yet it lacks an explicit front-loaded warning about privacy risk, minimum-access handling, and the consequences of misdelivery. In this context, omission of user-facing safeguards can normalize unsafe operation and increase the likelihood of accidental disclosure during real DSAR handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The invocation guidance is broad enough to trigger the skill in loosely related remediation, regulatory, and onboarding contexts without clear scoping limits. In a privacy/export skill that handles sensitive personal data and operational decisions, over-broad triggering can cause the agent to provide high-impact guidance or generate workflows in the wrong context, increasing the chance of inappropriate data handling or compliance mistakes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest describes a tool for Article 15/20 GDPR exports, CCPA/CPRA right-to-know, and SAR export pipelines, but this section instructs the skill to carry out vendor-side deletion requests for erasure. Deletion handling is a separate privacy right and operational workflow from access/portability, so implementing erasure actions goes beyond the skill's stated export-focused scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This scenario explicitly says to process Article 17 erasure requests and reuse the pipeline as 'extract and delete' rather than only designing access/portability exports. That is a meaningful behavior expansion beyond the manifest's stated purpose of building and operating data export pipelines for access and portability rights.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.