ClawHub
Back to skill

Security audit

AI Intel Daily

Security checks across malware telemetry and agentic risk

Overview

This skill coherently fetches public AI news feeds, translates snippets to Chinese, and saves a local digest, with ordinary third-party translation privacy caveats.

Install if you want a Chinese AI-news digest and are comfortable with the skill contacting public RSS sources and sending fetched article snippets to Google Translate. Avoid adding private or internal feeds unless you first disable or replace the external translation step.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises automatic translation through Google Translate without warning that fetched content may be transmitted to a third-party service. Even if the sources are mostly public RSS content, titles, summaries, and potentially user-selected feeds or derived text may leave the local environment, creating privacy, compliance, or data-handling concerns.

Natural-Language Policy Violations

Medium
Confidence
87% confidence
Finding
Mandating Chinese translation/output without user choice can cause unintended external processing and unexpected content transformation, especially when translation depends on a third-party service. This is primarily a consent and transparency issue rather than a direct exploit path, but it increases risk when users assume the tool only aggregates RSS locally.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
The documentation states that articles are translated into Chinese summaries but does not explain locale selection or whether users can disable translation. In a skill that processes external content automatically, lack of language-choice documentation reduces informed consent and can mask downstream privacy effects from translation services.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code sends article titles and summaries to googletrans, which relies on an external translation service, causing fetched content to leave the local environment. Even if the data is public RSS content, this creates an undisclosed data egress path and could expose sensitive feed contents if private or internal sources are ever added later.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.