Back to skill
Skillv1.0.0
ClawScan security
Ntriq X402 Compliance Check · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
ReviewApr 16, 2026, 12:00 PM
- Verdict
- Review
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill is coherent with a paid external compliance API, but it instructs sending arbitrary (possibly sensitive) text to an unknown third‑party endpoint and leaves payment/token handling ambiguous — potential data-exfiltration and billing risks merit caution.
- Guidance
- This skill calls a third‑party API and charges $0.03 USDC per call. Before installing or invoking it: (1) don't send real sensitive or regulated data (PHI, unredacted contracts, secrets) until you confirm the vendor's privacy/security/retention policies; (2) clarify how to obtain and supply the X-PAYMENT header — avoid pasting private keys or wallet seed phrases into prompts; (3) test with non-sensitive text to confirm behavior and charges; (4) verify the service operator (homepage and legal terms) and whether you need a business agreement (e.g., BAA for HIPAA) before sending protected data.
Review Dimensions
- Purpose & Capability
- okName and description claim an external compliance analysis service and the SKILL.md contains a single, consistent runtime instruction: POST the text to https://x402.ntriq.co.kr/compliance-check with an X-PAYMENT header. The requested actions line up with the stated purpose (paid API call).
- Instruction Scope
- concernInstructions tell the agent to transmit arbitrary 'text' to an external endpoint (including examples mentioning passwords and third‑party data). There is no warning about sending sensitive or regulated data (e.g., HIPAA PHI), no privacy/retention assurances, and the payment header mechanism is underspecified (agent/user will need to provide X-PAYMENT). This creates real risk of unintentionally exfiltrating confidential data or prompting users for wallet/payment secrets.
- Install Mechanism
- okInstruction-only skill with no install spec, no code files, and no binaries required — minimal local footprint and no filesystem or package installs.
- Credentials
- noteThe skill declares no required environment variables or credentials (proportionate). However, it requires an X-PAYMENT header for each call; SKILL.md does not explain how that header is obtained. That gap could lead an agent to request user wallet signatures or payment tokens at runtime, which would be disproportionate if not clearly documented.
- Persistence & Privilege
- okalways is false and the skill does not request persistent presence or modify other skills or system configuration. It does not request elevated privileges.