ClawHub
Back to skill

Security audit

Tax Paperwork Staging Board

Security checks across malware telemetry and agentic risk

Overview

This prompt-only skill organizes tax paperwork and does not request credentials, run code, use the network, or provide tax advice.

Installers should understand this skill helps organize sensitive tax paperwork but does not prepare or advise on a return. Avoid sharing full taxpayer IDs, passwords, or portal access with the assistant, use secure channels for documents, and ask for output in the language needed because the acceptance tests currently prefer English-first responses.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The acceptance test hard-codes an English-first requirement and rejects CJK-dominant output regardless of user need or locale. This creates a discriminatory behavior constraint that can prevent the skill from safely serving multilingual users, and in tax-document workflows it may cause misunderstanding, exclusion, or improper handoff when the user or reviewer works primarily in another language.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.