ClawHub
Back to skill

Security audit

Build Teams.ai Apps with Anthropic Claude

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent developer guide for adding Claude and optional You.com web tools to a Teams.ai app, with ordinary third-party API and data-sharing considerations.

Install only if your organization allows Teams messages and web-search inputs to be processed by Anthropic and You.com. Keep API keys out of source control, review and pin npm dependencies before production use, and disable or restrict the You.com MCP path for sensitive internal Teams workloads unless approved.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The MCP path encourages web search and content extraction but does not clearly disclose that user prompts and possibly fetched URLs/content may be transmitted to an external You.com service. In an enterprise Teams context, users may provide sensitive business data in prompts, so the lack of an explicit privacy/data-flow warning can lead to unintended third-party disclosure.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.