ClawHub
Back to skill

Security audit

EpidBot

Security checks across malware telemetry and agentic risk

Overview

The skill is a clearly disclosed EpidBot API integration for public-health data analysis, with appropriate warnings for external transmission and sensitive data handling.

Before installing, confirm you are comfortable sending prompts, files, and query content to the EpidBot service. Do not upload raw identifiable or regulated health records unless you have the required consent or legal basis, and use explicit confirmation before publishing any dataset because that can make it visible to all EpidBot users.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
## API Base URL

Default: `https://api.epidbot.kwar-ai.com.br/api/v1`

Configure via `EPIDBOT_BASE_URL` environment variable.
Confidence
94% confidence
Finding
The skill sends user messages, uploaded files, query results, and other content to an external third-party API, creating a real data exfiltration boundary. In this context the risk is elevated because the skill is explicitly designed for public-health workflows, which may involve regulated or sensitive health-related information subject to LGPD, HIPAA, or similar rules.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.