ClawHub
Back to skill

Security audit

Easydoc Mask

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built for medical-document masking, but it sends sensitive records to an external EasyLink service without enough clear warning or consent guidance.

Review carefully before installing. Use this only when you are authorized to send the selected medical or sensitive documents to EasyLink for processing, and verify your organization permits that endpoint, region, retention model, and API-key handling. Do not use it for regulated records unless third-party processing is approved.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill is designed to upload EMR and other potentially highly sensitive documents to a third-party API, but it does not prominently warn users that document contents leave the local system. For medical records, lack of explicit transmission disclosure can cause accidental exfiltration of regulated data and violate privacy or compliance expectations.

Natural-Language Policy Violations

Medium
Confidence
81% confidence
Finding
The skill hardcodes a single CN/EasyLink platform and does not explain the jurisdictional implication or offer alternatives. In the context of medical records, forcing a specific regional endpoint can create legal, privacy, or policy issues if users unknowingly transmit sensitive data across organizational or geographic boundaries.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation instructs users to upload EMR and other sensitive documents to a third-party service but does not clearly warn that full document contents and selected masking schema are transmitted off-system. In the context of medical records, this creates a meaningful privacy, compliance, and data-governance risk because operators may disclose PHI/PII to an external processor without informed consent or approval.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script is explicitly designed to upload local medical records and other potentially sensitive documents to a third-party API, but it does not provide a clear user-facing warning or consent checkpoint about external data transmission. In the context of EMR masking, this creates a real privacy and compliance risk because operators may unintentionally send regulated data off-host or across trust boundaries.

External Transmission

Medium
Category
Data Exfiltration
Content
Submit with default masking:

```bash
curl -X POST "https://api.easylink-ai.com/v1/easydoc/mask" \
  -H "api-key: your_apikey_here" \
  -F "files=@record.pdf" \
  -F "mode=emr-mask"
Confidence
89% confidence
Finding
https://api.easylink-ai.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Submit with custom fields:

```bash
curl -X POST "https://api.easylink-ai.com/v1/easydoc/mask" \
  -H "api-key: your_apikey_here" \
  -F "files=@record.pdf" \
  -F "mode=emr-mask" \
Confidence
91% confidence
Finding
https://api.easylink-ai.com/

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.