ClawHub
Back to skill

Security audit

Gr User Interview

Security checks across malware telemetry and agentic risk

Overview

This appears to be a coherent user-interview workflow skill, but users should handle recordings and transcripts carefully because they may contain private or confidential information.

Before installing or using this skill, make sure your team obtains explicit participant consent for screen sharing, recording, transcription, AI processing, and downstream sharing. Redact personal data, credentials, customer information, and confidential business details before sending transcripts to AI or issue trackers, and follow your organization’s retention and privacy rules.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly recommends shared-screen interviews and mandatory screen recording, but it does not instruct the operator to obtain informed consent or account for legal/privacy requirements. In user interviews, recordings may capture personal data, account information, messages, or confidential business context; absent consent and data-handling guidance, this creates privacy, compliance, and trust risks.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to feed interview transcripts to AI for feature and bug extraction without warning that transcripts may contain personally identifiable, confidential, or sensitive business information. Sending such content to third-party AI systems without minimization, redaction, consent, or approved vendor controls can result in unauthorized data exposure and policy/regulatory violations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly recommends screen-sharing and recording interviews, but it does not instruct the operator to obtain informed consent, provide notice, or comply with local recording/privacy laws. In a user-research context, this omission can lead to unauthorized capture of personal data, confidential business information, or legally protected communications, especially when transcripts are later processed by AI and shared into issue trackers.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.