Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Compliance Intel Mcp
v1.0.0Regulatory compliance analysis. Checks GDPR, SOX, HIPAA, PCI-DSS requirements and flags violations.
⭐ 0· 32·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description (regulatory compliance checks) match the code: handlers perform OFAC/OSHA/EPA/USASpending/GLEIF/EDGAR/SAM lookups and produce GO/CAUTION/BLOCK decisions. However SKILL.md claims "100% local AI inference (zero external API calls)" and local Qwen models, which the shipped code does not use — the implementation performs many external HTTP requests to public APIs. The SKILL.md also advertises an external payment endpoint (x402.ntriq.co.kr) and micropayments that are not reflected in the code or declared environment variables, which is inconsistent with the stated purpose and raises questions about where data/payment interactions actually occur.
Instruction Scope
SKILL.md runtime usage explicitly shows a curl to https://x402.ntriq.co.kr/compliance-check that returns HTTP 402 then triggers an "auto-pay USDC → get result" flow. That instructs an agent to send data (e.g., image_url/documents) to a remote host for payment-based processing — this is outside the stated "local inference" claim and could transmit sensitive information to an unknown external endpoint. The code itself performs network calls to many public government data endpoints (expected for this purpose) but there is a mismatch between instructions and implementation about where inference/payment happens.
Install Mechanism
There is no install spec (instruction-only on the registry), which minimizes supply-chain complexity. However the package.json and package-lock.json are present and declare dependencies (apify and many transitive packages). If the skill is executed, those npm packages would need to be installed; the registry metadata does not declare an install step or trusted release source for a binary. No remote download URLs or extract installs are present in the provided manifest.
Credentials
The skill declares no required environment variables or credentials, and the code mostly calls public endpoints that don't need API keys. But SKILL.md's external payment flow (auto-pay USDC on Base) implies a payment/wallet integration that would normally require credentials or signing — no env vars are declared for that, nor are payment-related calls visible in the included code. This mismatch is suspicious: the user would be instructed to contact a third-party endpoint for payment without any transparency about how payments/auth are performed or what data is sent.
Persistence & Privilege
The skill does not request always:true and does not declare system-level config changes or persistent elevated privileges. It appears to run on-demand and does not require persistent platform privileges.
What to consider before installing
What to consider before installing:
- The code implements the compliance checks and calls many public government APIs (OFAC SDN CSV, EPA ECHO, OSHA pages, USASpending, GLEIF, SEC EDGAR, SAM.gov). Those network calls are appropriate for this purpose but they will transmit the entity names you screen to third-party services.
- SKILL.md claims "100% local inference" and says processing is local, yet it also instructs agents to POST to https://x402.ntriq.co.kr for a paid result (auto-pay USDC). Those statements contradict each other. Clarify with the author whether any data or documents will be sent to x402.ntriq.co.kr and whether payment is mandatory.
- The payment endpoint is an external domain (x402.ntriq.co.kr) of unknown provenance. Do not send sensitive documents, PII, or customer data to that endpoint until you verify its owner, privacy policy, and how payments/receipts are handled. Ask for details about the micropayment flow and any wallet keys required.
- The package includes npm dependencies (apify ecosystem). If you plan to run the code, install and run it in an isolated environment or sandbox, review full source (the manifest omitted 3 files), and audit network calls to ensure no unexpected endpoints or exfiltration logic exist.
- If you need a fully local solution (no external network calls), this package does not match that promise — request a version that truly performs offline inference or an explanation of the local LLM integration.
If you want, I can: (1) scan the omitted files for any hidden endpoints or payment logic, (2) extract all outbound network hosts referenced by the code, or (3) draft questions to ask the skill author about payments and data handling.Like a lobster shell, security has layers — review code before you run it.
latestvk97f2gc02g6tk3vddjfdjcvxcd841sqk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.