ClawHub
Back to skill

Security audit

Umeå Data

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward tool for querying public Umeå municipal open data, with no evidence of hidden access, persistence, or data theft.

Reasonable to install if you want public Umeå open-data lookups. Be aware that it calls a public municipal API and depends on curl and jq; the nearest-location command may fail until the missing distance.jq helper is supplied or the package is fixed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
The file is primarily written in Swedish and all natural-language query examples are Swedish prompts, while it states "The AI can answer questions like:" without indicating that Swedish is required or optional. This can violate the language/locale policy criterion because the skill appears to force a specific language without explicit user opt-in or a clearly documented locale constraint.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.