ClawHub
Back to skill

Security audit

COPPA Check - COPPA合规检查

Security checks across malware telemetry and agentic risk

Overview

This COPPA checker is coherent and disclosed, but users should understand that scored checks send answers to compliancehub.cn and optional login stores an API key locally.

Before installing, be comfortable with compliance answers being sent to compliancehub.cn for scored reports. Use the account page or COMPLIANCEHUB_API_KEY if you do not want to type a password into the CLI, and treat the saved API key like any other local credential. Note that the preview command may still contact the cloud to fetch rule items.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
2. If the user wants a scored report, prompt them to get a free Key (`--login` or the account page), then run the full 检查.

## Security & data handling
- **Account credentials (only on explicit `--login`):** When you run `--login`/`--auth`, the skill prompts for your email + password and POSTs them ONLY to compliancehub.cn's official auth endpoints (/api/v1/auth/register, /api/v1/auth/login) to create your account and issue the free API Key.
- **Where data goes:** Check items are fetched from, and your answers are scored by, the CQDev cloud at
  `https://compliancehub.cn` (the operator's official endpoint). Scoring transmits only your item answers and the free API Key (as a Bearer token).
- **API Key storage (user-initiated only):** written **only when you run `--login`** to
Confidence
84% confidence
Finding
create your account and issue the free API Key. - **Where data goes:** Check items are fetched from, and your answers are scored by, the CQDev cloud at `https://compliancehub.cn` (the operator's off

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.