ClawHub
Back to skill

Security audit

Dpdp Compliance Assessment

Security checks for vulnerabilities and agentic risk

Overview

This skill is an API-backed compliance assessor, but it forces potentially sensitive organization details through a billable third-party service without requiring explicit submission approval.

Install only if you are comfortable sending your organization's DPDP readiness details to ToolWeb.in using your API key and accepting possible quota or billing usage. Before using it, avoid entering secrets, incident evidence, internal hostnames, personal data, or confidential free-text details, and get authorization to disclose the organization's compliance and security posture.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:43
Finding

Mandatory Billable Third-Party API Invocation Overrides Normal Agent Behavior

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:82
Finding

Sensitive Organizational Compliance Posture Is Transmitted Without Explicit Submission Consent

Content
View full analysis
10M)") - `geographic_scope` — Operations scope (e.g., "India only", "India + International", "Global with India operations") **Assessment responses** — For each of the 41 questions, gather the user's answer. Responses are mapped as question ID to answer string in the `responses` dictionary. ``` The collected information is then submitted externally: ```bash curl -s -X POST "https://portal.toolweb.in/apis/compliance/dpdp-compliance" \ -H "Content-Type: application/json" \ -H "X-API-Key: $TOOLWEB_API_KEY" \ -d '{ "organization_name": "", "industry_sector": "", "organization_size": "", "data_volume": "", "geographic_scope": "", "responses": { "dg_01": "", "dg_02": "", ... "pg_06": "" }, "include_roadmap": true }' ``` ### Technical Analysis The workflow collects an organization's identity, size, geographic scope, personal-data volume, and answers concerning 41 privacy and security controls. These responses can expose weaknesses in data inventory, consent handling, access control, encryption, monitoring, breach response, vendor governance, and privacy management. The collected payload is sent to `portal.toolweb.in` with no required confirmation step showing the ...[truncated 1806 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill directs the agent to collect detailed organizational compliance responses and transmit them to a third-party API, but it does not require explicit user consent or a warning that the data will leave the local environment. Because the payload can include sensitive internal governance, security, vendor, breach-response, and privacy-process information, users may unknowingly disclose confidential assessment data to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The curl command performs a POST to an external endpoint and includes extensive organizational assessment data in the request body. In this context, the transmitted information may reveal security controls, breach readiness, vendor governance, and compliance gaps, creating confidentiality and privacy risks if sent without informed approval or if the third-party service is compromised or mishandles the data.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

  1. Call the API:
bash
curl -s -X POST "https://portal.toolweb.in/apis/compliance/dpdp-compliance" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $TOOLWEB_API_KEY" \
  -d '{

Static analysis

No suspicious patterns detected.