ClawHub
Back to skill

Security audit

Easydoc Extract

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward document-extraction helper that sends user-selected files to EasyLink’s API, with privacy considerations users should understand before use.

Install only if you are comfortable sending selected documents and extracted contents to EasyLink for remote processing. Avoid regulated, confidential, customer, financial, or identity documents unless you have authorization and have reviewed EasyLink’s privacy, retention, and regional handling terms. Save results only to secure locations, and do not use --base-url unless you fully trust the destination.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill is designed to upload user-supplied documents to a third-party API for processing, including potentially sensitive records like business licenses and certificates, but it does not explicitly warn users that document contents leave the local environment. This creates a meaningful privacy and consent risk because users may unknowingly transmit confidential or regulated data to an external service.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation instructs users to upload documents to a third-party extraction API but does not warn that file contents may contain sensitive or regulated data that will leave the local environment. In a skill whose purpose is document extraction, this omission materially increases the chance of accidental exfiltration of PII, financial records, or business documents.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script uploads local document files to a third-party API endpoint, but it does not provide any explicit privacy or data-transmission warning at the point of use. Because this skill is specifically designed for document extraction, users may pass highly sensitive documents (IDs, licenses, financial records) and unintentionally transmit them off-host without informed consent.

Missing User Warnings

Low
Confidence
84% confidence
Finding
When --save is used, the script writes extracted results to disk without warning that the output may contain sensitive structured data derived from uploaded documents. This can lead to accidental local exposure through insecure file locations, backups, shared workspaces, or permissive filesystem access.

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.