ClawHub
Back to skill

Security audit

CogDx Bias Scan

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only paid API integration that openly sends selected prompt and response samples to Cerebratech for bias analysis.

Install only if you trust Cerebratech with the examples you submit. Before running a scan, confirm the $0.10 or credit cost, remove secrets and personal or regulated data from prompts and responses, and use a limited wallet or credit balance for payment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill advertises broad trigger phrases such as "scan for bias," "detect my biases," and "systematic errors," which are common in ordinary conversation and could cause unintended invocation. Because this skill sends agent outputs and prompts to a paid third-party API, accidental triggering can lead to unnecessary data disclosure and billing without clear user intent.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs sending prompts, responses, contexts, and failure feedback to an external service but does not prominently warn that potentially sensitive reasoning traces and model outputs will leave the local environment. This creates a real privacy and compliance risk, especially if the traces contain confidential user data, internal prompts, regulated data, or proprietary business information.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The API reference explicitly instructs sending prompts, responses, optional context, and failure feedback/user complaints to an external service, but provides no privacy notice, consent requirement, data minimization guidance, or warning against including sensitive data. In a bias-analysis skill, those fields can easily contain personal, confidential, or proprietary information, so the omission creates a real risk of unintended data exfiltration and compliance/privacy violations.

External Transmission

Medium
Category
Data Exfiltration
Content
# CogDx Bias Scan API Reference

## Endpoint
`POST https://api.cerebratech.ai/bias_scan`

## Payment Options
Confidence
85% confidence
Finding
This file hardcodes an external endpoint and the skill is designed to transmit model outputs and related feedback to that third-party service. External transmission is expected for the feature, but it is still security-relevant because the payload includes potentially sensitive inference data and optional complaints/context, increasing exposure to third-party handling, interception, or misuse if not clearly governed.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.