ClawHub
Back to skill

Security audit

Câmara dos Deputados

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent open-data helper for Brazil Chamber of Deputies research and does not show hidden, destructive, credential, or persistence behavior.

This appears safe for normal use as an open-data research skill. If installing in a locked-down or production environment, consider pinning dependencies or using a reviewed lockfile before installation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.27.0
Confidence
93% confidence
Finding
The dependency is specified with only a lower bound (httpx>=0.27.0), which makes installs non-reproducible and allows future major or minor releases to be pulled in automatically. That can introduce vulnerable, malicious, or breaking versions into the environment through the supply chain without any review or testing gate.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.