ClawHub
Back to skill

Security audit

GDPR Compliance Document Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed GDPR document-drafting skill with legal-review warnings and no code execution, persistence, credential access, or data exfiltration behavior.

Use this as a drafting aid, not as final legal advice. Before adopting generated documents, have a qualified privacy professional, solicitor, DPO, or accountable business owner verify the factual inputs, lawful bases, retention periods, international-transfer mechanisms, and any high-risk processing such as health data, children’s data, AI screening, CCTV, or breach response.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill markets 'implementation-ready' GDPR documents for businesses handling personal data, including high-risk contexts like healthcare, recruitment AI screening, and special-category data, but the warning is limited to a brief note that it is 'not legal advice' and should be reviewed before implementation. That disclaimer does not clearly communicate that generated outputs may be incomplete, inaccurate, or unsuitable for high-risk processing, which could lead users to deploy deficient compliance documents and create regulatory, contractual, and privacy risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
|---|---|---|---|
| Marketing emails (existing customers) | Legitimate Interest (soft opt-in) | PECR Reg 22, Art 6(1)(f) | Must offer opt-out at point of collection and in every message. Only for similar products/services. |
| Marketing emails (prospects) | Consent | PECR Reg 22, Art 6(1)(a) | Must be opt-in. No pre-ticked boxes. Record of consent required. |
| Marketing emails (B2B — corporate subscribers) | Legitimate Interest | PECR Reg 22(3) | B2B exception — can email corporate addresses without consent if relevant to role. Must still identify sender and offer opt-out. |
| Employment records | Legal obligation / Contract | Art 6(1)(b), 6(1)(c) | Contract for payroll/benefits. Legal obligation for tax, right-to-work, health and safety. |
| Website analytics (cookies) | Consent | PECR Reg 6, Art 6(1)(a) | Strictly necessary cookies exempt. All analytics/tracking cookies require prior consent. |
| CCTV / video surveillance | Legitimate Interest | Art 6(1)(f) | Must complete a Legitimate Interest Assessment. Signage required. DPIA if systematic monitoring of public areas. |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 707)May include surrounding context.

md
|---|---|---|---|
| Marketing emails (existing customers) | Legitimate Interest (soft opt-in) | PECR Reg 22, Art 6(1)(f) | Must offer opt-out at point of collection and in every message. Only for similar products/services. |
| Marketing emails (prospects) | Consent | PECR Reg 22, Art 6(1)(a) | Must be opt-in. No pre-ticked boxes. Record of consent required. |
| Marketing emails (B2B — corporate subscribers) | Legitimate Interest | PECR Reg 22(3) | B2B exception — can email corporate addresses without consent if relevant to role. Must still identify sender and offer opt-out. |
| Employment records | Legal obligation / Contract | Art 6(1)(b), 6(1)(c) | Contract for payroll/benefits. Legal obligation for tax, right-to-work, health and safety. |
| Website analytics (cookies) | Consent | PECR Reg 6, Art 6(1)(a) | Strictly necessary cookies exempt. All analytics/tracking cookies require prior consent. |
| CCTV / video surveillance | Legitimate Interest | Art 6(1)(f) | Must complete a Legitimate Interest Assessment. Signage required. DPIA if systematic monitoring of public areas. |

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions require every output to use UK English throughout, which imposes a specific language/locale on all users. This is a natural-language policy concern because the skill does not provide any opt-in, alternative locale, or user choice despite being user-invocable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The listing markets generation of GDPR/privacy compliance documents as implementation-ready and tailored, but does not clearly state that outputs are not legal advice and may be incomplete, jurisdiction-specific, or require review by qualified counsel. Users may rely on the generated documents as legally sufficient, leading to defective notices, invalid consent mechanisms, missed DPIA/ROPA obligations, or noncompliant breach handling that creates regulatory and contractual exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.