ClawHub
Back to skill

Security audit

CCPA Check - CCPA合规检查

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed CCPA/CPRA self-check tool that uses a cloud scoring service and local API-key storage in ways that fit its stated purpose.

Install only if you are comfortable sending compliance answers, and login credentials during --login, to compliancehub.cn. Be aware that preview mode still attempts a public rule-library fetch despite being described as offline; use network controls if you require a no-network run.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
2) private store ~/.config/compliancehub/<slug>.key (mode 0600)
      3) legacy references/api_key.md (read-only, kept for backward compat)
    """
    env_key = os.environ.get("COMPLIANCEHUB_API_KEY")
    if env_key and env_key.strip():
        return env_key.strip()
    p = _key_path()
Confidence
70% confidence
Finding
os.environ.get("COMPLIANCEHUB_API_KEY

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.