Mova Compliance Audit

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed compliance-audit skill that sends selected documents to MOVA-related services and creates audit records, so it is appropriate when that processing is authorized.

Use this only for documents your organization is allowed to submit to MOVA and its connectors. Before installing, review the openclaw-mova plugin, provider terms, data retention, access controls, and who can register live compliance connectors or sign audit decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill description and trigger metadata are broad enough to activate on generic document-review or regulation-related requests, which can cause over-invocation outside the user's intended task. In a compliance workflow that sends document identifiers, content-derived structure, and audit metadata to external services, accidental triggering can expose sensitive documents to unnecessary external processing.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The invocation guidance includes phrases like preparing for a regulatory inspection and broad mentions of compliance or audit without concrete exclusion boundaries, making unintended activation likely. Because this skill forwards document URLs/IDs and extracted content to external systems, ambiguous triggers increase the risk of privacy, confidentiality, and workflow-integrity issues from misrouted tasks.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal