GDPR Audit - GDPR合规审计

• Outcome: Pass
• Latest audit: Aug 10, 2026 · 8:19 AM UTC
• Version: 1.0.6

Overview

This is a purpose-aligned GDPR audit skill that discloses cloud scoring and API-key storage, with one caveat that its preview mode still fetches cloud rules despite claiming to be fully offline.

Install only if you are comfortable sharing GDPR checklist answers with compliancehub.cn for scored runs and with storing a service API key locally after --login. Do not rely on --non-interactive as strictly offline unless network access is blocked, because the current code tries to fetch the cloud rule library before showing the preview.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: This markdown repeatedly presents the skill and its usage in a mixed English/Chinese form, including headings, trigger phrases, and agent guidance, but does not state that the user can choose their preferred language. Under the policy rule, forcing or assuming a specific language/locale without opt-in can be a natural-language policy issue.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest’s user-facing natural language is entirely in Chinese, including the description and warnings, with no indication that the skill supports other languages or that it is intended only for Chinese-speaking users. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The only natural-language content in this file is a Chinese comment stating there are no third-party dependencies. This indicates a fixed language choice with no user opt-in or alternative locale, which can conflict with language/locale policy requirements.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code file embeds the core audit checklist text entirely in Chinese, while the surrounding CLI and report text are otherwise in English. That creates a language/locale policy issue because users are not given an opt-in or alternative locale, and the file does not clearly document that the skill is intended only for Chinese-speaking users or a China-specific compliance context.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def load_api_key():
    env_key = os.environ.get("COMPLIANCEHUB_API_KEY")
    if env_key and env_key.strip():
        return env_key.strip()
    p = _key_path()

• Confidence: 70% confidence
• Finding: os.environ.get("COMPLIANCEHUB_API_KEY

Session Persistence

Medium

• Category: Rogue Agent

Content

2. If the user wants a scored report, prompt them to get a free Key (`--login` or the account page), then run the full 审计.

## Security & data handling
- **Account credentials (only on explicit `--login`):** When you run `--login`/`--auth`, the skill prompts for your email + password and POSTs them ONLY to compliancehub.cn's official auth endpoints (/api/v1/auth/register, /api/v1/auth/login) to create your account and issue the free API Key.
- **Where data goes:** Check items are fetched from, and your answers are scored by, the CQDev cloud at
  `https://compliancehub.cn` (the operator's official endpoint). Scoring transmits only your item answers and the free API Key (as a Bearer token).
- **API Key storage (user-initiated only):** written **only when you run `--login`** to

• Confidence: 60% confidence
• Finding: create your account and issue the free API Key. - **Where data goes:** Check items are fetched from, and your answers are scored by, the CQDev cloud at `https://compliancehub.cn` (the operator's off

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.