ClawHub
Back to skill

Security audit

REDCap Data Dictionary Generator

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does what it says, but it instructs agents to send generated clinical-study CSV output through Feishu without clear destination, consent, or privacy controls.

Install only if your workflow intentionally uses Feishu for delivery. Before using it with clinical, patient-related, or institutional documents, confirm the recipient/channel, get appropriate authorization, and consider using the local CSV output only. The scripts themselves do not show hidden network calls, but the runtime instructions should be reviewed carefully.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The usage instructions state that the generated CSV is sent via Feishu, but there is no documented integration, transport behavior, or security controls for that transmission. For clinical documents and derived data dictionaries, undocumented external sharing behavior creates uncertainty around data handling, auditability, and privacy compliance.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill is designed for clinical trial CRF/protocol documents, which commonly contain direct and indirect patient identifiers, yet the instructions mention sending outputs via Feishu without a clear privacy warning or consent model. If users upload regulated medical content assuming local-only processing, undisclosed external transmission could expose sensitive health information and create compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.