ClawHub
Back to skill

Security audit

EU AI Act Compliance

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only compliance guidance skill for HR AI risk assessment, with no hidden execution, persistence, or data export behavior found.

Use this for general compliance scoping and gap analysis, but redact or anonymise real candidate, employee, biometric, performance, and hiring data before sharing. Treat the output as informational, verify current legal deadlines and requirements against official sources, and consult qualified counsel for actual compliance decisions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README encourages users to submit details about recruitment, candidate ranking, performance assessment, and GDPR Article 22 scenarios, all of which commonly involve personal data and may include special-category or sensitive employment information. Without an explicit warning to avoid sharing real candidate or employee data, users may paste confidential HR information into the skill or linked services, creating privacy, confidentiality, and regulatory exposure.

Static analysis

No suspicious patterns detected.