ClawHub

LLMWhisperer

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward LLMWhisperer API wrapper, but it sends chosen documents to a third-party service.

Install only if you are comfortable sending selected PDFs or images to LLMWhisperer/Unstract for processing. Avoid confidential or regulated documents unless your policies allow that provider, keep the API key private, and note that the referenced script path is not present as a separate packaged file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill uploads the user-supplied file to a third-party LLMWhisperer API, but the description does not clearly disclose that document contents leave the local environment. This creates a real privacy and compliance risk because users may process sensitive PDFs or images under the mistaken assumption that extraction happens locally.

External Transmission

Medium
Category
Data Exfiltration
Content
exit 1
fi

curl -s -X POST "https://llmwhisperer-api.us-central.unstract.com/api/v2/whisper?mode=high_quality&output_mode=layout_preserving" \
  -H "Content-Type: application/octet-stream" \
  -H "unstract-key: $LLMWHISPERER_API_KEY" \
  --data-binary "@$FILE"
Confidence
97% confidence
Finding
curl -s -X POST "https://llmwhisperer-api.us-central.unstract.com/api/v2/whisper?mode=high_quality&output_mode=layout_preserving" \ -H "Content-Type: application/octet-stream" \ -H "unstract-key:

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal