ClawHub
Back to skill

Security audit

UmowaGenerator

Security checks across malware telemetry and agentic risk

Overview

This is a simple Polish contract-template generator with privacy and reliability caveats, but no evidence of hidden access, data exfiltration, persistence, or destructive behavior.

Use placeholders while drafting, and enter real PESEL/NIP, addresses, payment details, or property data only when needed. Review contracts with appropriate legal judgment before relying on them. Treat any separate PRO payment link, PDF export, or email-sending workflow as outside the reviewed code and verify how it stores or transmits personal data before using it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The documented contract-generation entry point is broken because the zlecenie path ultimately references an undefined variable (`lieu_of_work`) inside `generate_zlecenie_content`, causing a runtime failure instead of producing the requested contract. In a skill context, this is a reliability and availability issue rather than direct code execution, but it can cause denial of service for normal use and may lead users to trust incomplete or nonfunctional legal-document generation.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill explicitly advertises sending contracts by email, while the surrounding context shows those contracts contain highly sensitive personal data such as names, addresses, and PESEL/NIP. Without any warning about privacy, consent, recipient verification, encryption, or email security, users may transmit regulated personal data through an insecure or misaddressed channel, causing unauthorized disclosure.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill promotes PDF export for legal contracts that include sensitive identifiers and address data, but it does not warn that exporting creates a persistent file on disk. This increases the risk of local data exposure through shared devices, backups, cloud sync, malware, or improper retention, especially because users may assume generation is transient.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script processes and prints highly sensitive personal data such as PESEL, NIP, names, and addresses directly into terminal output and generated documents without any privacy notice, masking, minimization, or safer handling guidance. In this context, the danger is accidental exposure through console history, logs, screenshots, copied output, or insecure storage of generated contracts containing regulated personal information.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.