ClawHub
Back to skill

Security audit

senado-federal

Security checks across malware telemetry and agentic risk

Overview

This skill is a read-only client for official Brazilian Senate open-data APIs, with administrative transparency data disclosed in its documentation.

Before installing, understand that the skill can retrieve public administrative transparency records that may include personal or financial fields from official Senate datasets. Use care when summarizing or republishing those records, and consider pinning dependencies if you require reproducible installs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill manifest says the capability is for legislative and administrative open-data research, but this file exposes a much broader set of administrative transparency endpoints including server remuneration, pensioners, interns, outsourced workers, housing assistance, and corporate card data. That expansion materially increases access to potentially sensitive personal and financial records and creates a data-minimization and scope-creep risk, especially if downstream agents assume the skill is limited to legislative research.

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.27.0
Confidence
94% confidence
Finding
The dependency specification uses a lower-bound only constraint (`httpx>=0.27.0`), which allows future major or minor releases to be installed without review. This can introduce supply-chain risk, unexpected breaking changes, or newly introduced vulnerable versions into the skill environment, especially when builds are not fully reproducible.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.