ClawHub
Back to skill

Security audit

Eudic Openapi Skills Local

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Eudic API helper, but it can change or delete vocabulary lists, words, and notes when given a valid token.

Install only if you are comfortable giving your agent a Eudic API token. Keep the token private, confirm any delete or rename request by exact item name and ID before it runs, and upload only audio files you intend to send to Eudic for scoring.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill documents a destructive delete operation for study-list categories but provides no guidance to require explicit user confirmation, scope validation, or safeguards against accidental deletion. In an agent setting, this can cause unintended permanent data loss if a user request is ambiguous or misinterpreted.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documented delete-words endpoint allows destructive removal of vocabulary entries without warning the operator to confirm the exact words and target list. This increases the chance of accidental bulk deletion or deletion from the wrong category when used by an automated agent.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill includes note deletion instructions without any user-warning or confirmation requirement, which can lead to irreversible loss of personal study data if an agent acts on a mistaken or injected instruction. The absence of protective guidance is risky because notes may contain user-authored content that cannot be reconstructed.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.