ClawHub
Back to skill

Security audit

ct-advisor

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent, but its shipped config can enable unencrypted Q&A logging despite documentation saying logging is off by default.

Review and change config.json before installing if you do not want local Q&A logs. In particular, remove or disable qa_store.mode: local unless you intentionally want unencrypted records in data/qa_log.jsonl. Also verify clinical and regulatory conclusions with official sources, especially for current deadlines, versions, and submission decisions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The changelog shows a materially false security/quality claim: version 0.8.0 states that every answer is dual-model cross-checked, while 0.8.2 later admits that capability was unimplemented and only on the roadmap. In a clinical-trial advisory skill, inaccurate claims about verification can cause users to overtrust outputs and make higher-stakes decisions under a false assurance of review.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The README states that output language defaults to the user's OS language, which means environment-derived metadata influences behavior without explicit consent. While low severity, this can reveal locale or system characteristics and may cause unintended processing or disclosure in a language the user did not choose, which is undesirable in a privacy-sensitive clinical-trial context.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The JsonlStore appends full question, answer, citations, grounded data, and feedback to a local JSONL file, which can include sensitive clinical, regulatory, or potentially personal data. Although the file comments say this mode requires explicit configuration and defaults to NoOpStore, there is no runtime notice, consent check, minimization, redaction, or access-control logic in this code path, so enabling it creates a real privacy and data-retention risk.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The prompt instructs the agent to automatically switch to Chinese based on OS locale or detected Chinese input without explicit user opt-in. That creates a privacy and policy-boundary issue because locale is environment-derived metadata the user may not expect to influence behavior, and it can also cause unintended disclosure of inferred attributes or produce responses in a language the user did not explicitly choose in regulated workflows.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.