ClawHub
Back to skill

Security audit

Open Data Integrator

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed construction data-integration helper with broad but purpose-aligned file and network permissions and no evidence of hidden collection or destructive behavior.

Install this only if you are comfortable granting file and network access for construction data analysis. Provide only the project files and provider API keys needed for a given task, and treat the included connector data as demo/sample data unless you or the agent implement live API retrieval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The class docstring labels this as a connector for weather data such as OpenWeatherMap, and the method docstring says it fetches weather data for a location. However, the implementation explicitly 'Simulate[s] API call' and returns hard-coded/generated sample records instead of retrieving real source data, which contradicts the documented intent.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
The natural-language content includes a non-English title alongside an English one, which can create an implicit language expectation in a generally English skill document. Because the file does not state that multilingual content is optional or user-selectable, this is a mild language/locale policy concern.

External Transmission

Medium
Category
Data Exfiltration
Content
def __init__(self, api_key: Optional[str] = None):
        self.api_key = api_key
        self.base_url = "https://api.openweathermap.org/data/2.5"

    def fetch(
        self,
Confidence
50% confidence
Finding
https://api.openweathermap.org/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.