ClawHub
Back to skill

Security audit

Anthrovision Telegram Body Scan Free

Security checks across malware telemetry and agentic risk

Overview

This skill performs the advertised body-scan workflow, but it sends sensitive body videos to an external service without a real consent gate and requests unnecessary command-execution authority.

Review this carefully before installing. Only use it for videos you are authorized to submit, and assume the video and measurements leave the local agent for external processing. Prefer a version that requires explicit consent before upload, explains retention and privacy handling, and removes unnecessary exec/ping troubleshooting authority.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The skill’s error-handling guidance tells the agent to execute a host-level `ping` command even though the skill’s intended purpose is only to validate inputs and submit/poll a body-scan workflow. Introducing unrelated command execution expands the agent’s privileges and creates a path for unnecessary system interaction, which is especially risky in skills exposed to user-controlled failures or troubleshooting flows.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The documentation grants or encourages host-level network-diagnostic command execution that is not justified by the business purpose of a basic Telegram body-scan submission skill. This violates least-privilege principles and increases the attack surface, because a user can potentially steer the agent into executing local commands under the guise of troubleshooting.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill describes uploading body videos to an external bridge service without clearly warning users that highly sensitive biometric-like media and derived measurements leave the local agent context. That omission can cause users to share intimate personal data without informed understanding of third-party processing, retention, or exposure risks.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill explicitly notes that it does not provide an explicit consent flow for processing real-person videos, yet it still enables submission of such videos for external analysis. For body videos and measurement extraction, lack of consent collection materially increases privacy, legal, and abuse risk, including non-consensual analysis of another person’s intimate visual data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.