ClawHub
Back to skill

Security audit

PREGNA-RISK: Pregnancy Risk in SLE/APS

Security checks across malware telemetry and agentic risk

Overview

This is a local pregnancy-risk calculator, but it gives high-stakes medical recommendations without enough up-front clinical safety and privacy guardrails.

Review carefully before installing or using. Treat this only as clinician-supervised decision support, avoid entering real patient identifiers unless your environment is approved for health data, and do not use the score or recommendations to make pregnancy, medication, monitoring, or delivery decisions without qualified MFM/rheumatology review.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
This skill provides concrete pregnancy risk categories and management recommendations, including advice to defer pregnancy, consider inpatient monitoring, and early delivery planning, without a clear clinician-use limitation, patient-safety warning, or statement that it is not a substitute for specialist judgment. In a high-stakes medical context involving SLE/APS pregnancy, users may over-trust the score or apply recommendations without appropriate validation, potentially causing harmful delays, undertreatment, overtreatment, or unsafe obstetric decisions.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The JSON/API path reads arbitrary input from stdin and returns both the supplied patient identifier and derived pregnancy risk information verbatim, which constitutes sensitive health data handling without any privacy controls, minimization, consent notice, or safeguards against downstream logging/exposure. In a clinical-risk tool, this context increases concern because the output is medically sensitive and may be integrated into pipelines, logs, or monitoring systems where identifiers and risk assessments could be unintentionally disclosed.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.