ClawHub
Back to skill

Security audit

InsurAI Taiwan Personal Insurance

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Taiwan insurance API helper; it handles sensitive insurance details, but its data flow and consent requirements are documented and proportionate to the task.

Install only if you are comfortable sending the minimum necessary Taiwan insurance-planning details to the configured InsurAI API. Redact national IDs, contact details, payment data, medical records, and unrelated policy pages, and confirm any external OCR/document processor's privacy terms before using images or PDFs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill uses sensitive capabilities—network access and environment-variable access for API credentials—but does not declare permissions in a machine-readable way. This creates a transparency and governance gap: reviewers or platforms may not realize the skill can transmit user insurance data and use secrets, increasing the risk of unintended data exposure or policy bypass.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger phrases are broad enough to match routine insurance conversation, which can cause the skill to activate on ambiguous user intent and begin processing highly sensitive policy and personal-financial data. In this skill's context, accidental activation is more dangerous because later steps involve OCR, external services, and detailed profile analysis.

Missing User Warnings

High
Confidence
97% confidence
Finding
The workflow instructs users to send policy images/PDFs through external OCR and then analyze extracted text, but it does not warn about the privacy and data-handling implications of transmitting sensitive insurance, health-adjacent, and personal-profile information to third parties. This creates a real risk of unauthorized disclosure, over-collection, and non-compliant handling of personal data, especially given the combination of policy details, demographics, family status, debt, and occupation.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.