ClawHub
Back to skill

Security audit

Data Governance Maturity

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward external API integration for data governance maturity assessments, with a privacy caveat about the assessment data and identifiers it sends.

Before installing, confirm you trust the ToolWeb/API provider and avoid submitting secrets, unnecessary personal identifiers, or highly detailed internal weaknesses unless your organization is comfortable sending that information to the external assessment service.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The skill requests userId, sessionId, timestamps, and assessment responses but provides no privacy notice, retention policy, minimization guidance, or handling constraints. Even if these fields are not inherently secret, they can become sensitive when tied to organizational governance posture and user activity, creating unnecessary exposure and compliance risk when sent to a third-party service.

Static analysis

No suspicious patterns detected.