ClawHub
Back to skill

Security audit

ai-insurance-advisor

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed, local insurance-advice helper with financial-advice caveats and no evidence of hidden exfiltration, persistence, or destructive behavior.

Before installing, treat recommendations as informational insurance guidance, verify product availability and premiums with official providers, and be aware the skill includes an opt-in prompt that can provide a specific insurance sales-company phone number.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
这是描述与代码不完全匹配的情况。代码覆盖了描述中的部分能力，包括保险需求分析、保障缺口分析、方案设计、部分险种推荐以及保费计算；这些都与保险配置/方案相关。但声明把技能描述成一个范围很广的“保险AI助手”，包含核保合规、理赔、朋友圈文案、培训话术、代理人展业支持等能力，而代码中完全没有对应实现，也没有外部服务、模型调用或相关处理逻辑。代码的主要目的更像是规则驱动的保险分析与方案/保费工具集，而不是完整的多功能保险助手。因此应判定为描述夸大了实际能力，存在不匹配。

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.