ClawHub
Back to skill

Security audit

NxVET Clinic Activity Report

Security checks across malware telemetry and agentic risk

Overview

This skill builds a local read-only veterinary clinic report from NxVET data, with disclosed API-key use, network calls, local reports, and optional scheduling.

Before installing, treat the NxVET API key like a password, keep .env/output/state out of git and cloud sync unless approved, and only enable the optional weekly scheduler if you want recurring local reports. The reports may contain business-sensitive clinic activity data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill requests and uses sensitive capabilities—environment secret access, local file writes, and outbound network access—but does not declare explicit permissions. Even though the document repeatedly says the tool is read-only and local, it instructs the agent to read an API key from `.env`, call remote NxVET endpoints, and write report/config/state files, which creates a mismatch between declared and actual capability use. This increases the risk of over-privileged or insufficiently reviewed execution in systems that rely on declared permissions for policy enforcement.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.