ClawHub
Back to skill

Security audit

Rental Management

Security checks across malware telemetry and agentic risk

Overview

This rental-management skill is mostly transparent and non-malicious, but its tenant-screening guidance includes housing-discrimination and privacy-risk practices that users should review before relying on it.

Install only if you are prepared to revise the tenant-screening SOP before use: remove nationality-based screening, apply the same identity and financial checks to all applicants where lawful, avoid tenant-plus-ID photos and neighbor monitoring, and add consent, secure storage, retention, deletion, and local legal-compliance controls for any sensitive applicant data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The guidance flags '外國人' (foreigners) for extra scrutiny as a blanket category, which introduces nationality-based differential treatment unrelated to individualized risk assessment. In a rental-management SOP, this can drive discriminatory screening decisions and expose users to legal, regulatory, and civil liability, especially because the criterion is presented operationally rather than as a jurisdiction-specific compliance check.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The SOP instructs collection of sensitive identity and financial records, including ID copies, salary proof, credit reports, and guarantor documents, without any minimization, retention limits, consent notice, or secure-storage guidance. This creates unnecessary privacy and data-protection risk: misuse, overcollection, identity theft, and unauthorized disclosure become much more likely when non-expert landlords follow the procedure as written.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The recommendations to conduct periodic inspections, use neighbors as informal monitors, and take a photo of the tenant together with their ID promote surveillance-style practices without discussing consent, scope limits, or legal restrictions. In landlord-tenant operations, this can normalize intrusive monitoring and excessive identity capture, increasing the risk of harassment claims, privacy violations, and downstream abuse of highly sensitive personal data.

Natural-Language Policy Violations

High
Confidence
98% confidence
Finding
The SOP explicitly subjects foreigners to additional documentation and scrutiny as a class, without a documented legal necessity or user-selected compliance context. This is a direct discriminatory screening pattern in housing, and in this skill context it is especially dangerous because it operationalizes bias into a repeatable process for landlords and property managers.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.