ClawHub
Back to skill

Security audit

Bid Dup Check 1.1.0

Security checks across malware telemetry and agentic risk

Overview

This skill locally analyzes user-provided bid documents for duplicate-content and collusion risk, with sensitive-data handling that is expected for that purpose but worth using carefully.

Install only for bid documents you are authorized to process. Expect the skill to read document contents and metadata, extract sensitive fields, and leave temporary JSON, image, Word, and Markdown outputs in the workspace until cleaned up. Redact unnecessary personal or banking details when possible and manually review results before using them for high-stakes procurement decisions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill explicitly instructs the agent to read uploaded files, write extracted JSON and generated reports, and resolve filesystem paths, but it does not declare the corresponding permissions. Undeclared file read/write capability weakens platform trust boundaries and can cause the skill to access or persist sensitive bid documents in ways users and enforcement layers cannot clearly audit or constrain.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README encourages users to upload bid/tender documents that commonly contain sensitive personal and corporate data, including phone numbers, bank accounts, ID-like registration numbers, and document metadata, but it does not present a clear warning or handling guidance at the point of use. In this skill context, that omission is more dangerous because the feature set explicitly extracts and compares exactly those sensitive fields, increasing the chance of over-collection, improper sharing, or accidental disclosure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.