ClawHub
Back to skill

Security audit

Paper Compare

Security checks across malware telemetry and agentic risk

Overview

This skill is a transparent research helper for comparing papers, with a privacy caveat because it saves comparison history.

Install this if you are comfortable with a research assistant using web/PDF retrieval tools and saving paper-comparison history. For confidential research, unpublished PDFs, sensitive strategy, or private literature reviews, tell the agent not to save or use history and avoid submitting material you do not want retained.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly stores a persistent comparison history containing the user's research goal, paper references, topic, comparison angle, verdict, and extracted dimensions, but it does not require user consent, provide notice, or define retention/deletion behavior. Research topics and selected papers can reveal sensitive interests, confidential workstreams, or unpublished directions, so silent persistence creates a privacy and data-governance risk.

Ssd 3

Medium
Confidence
91% confidence
Finding
The persistence design lacks minimization and sensitivity boundaries: it stores free-form user_goal plus detailed paper metadata and verdict data in a shared history structure. Without constraints on sensitive content, access scope, or retention, the memory file can accumulate behavioral profiles or confidential research intent that may later be exposed to other workflows or unauthorized readers.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.