ClawHub
Back to skill

Security audit

GDPR Check - GDPR合规检查

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed GDPR checklist that uses a third-party cloud service only for preview, login, and scoring as described.

Before installing, be comfortable with using compliancehub.cn: preview mode fetches checklist items, scored runs send your checklist answers and API key to that service, and --login sends email and password to create or access an account. Use --non-interactive for a no-answer preview, and remove ~/.config/compliancehub/gdpr-check.key if you later want to clear the saved key.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def load_api_key():
    env_key = os.environ.get("COMPLIANCEHUB_API_KEY")
    if env_key and env_key.strip():
        return env_key.strip()
    p = _key_path()
Confidence
70% confidence
Finding
os.environ.get("COMPLIANCEHUB_API_KEY

Session Persistence

Medium
Category
Rogue Agent
Content
falls back to the bundled item set. Scored runs require a free API Key.
  🔐 Account provisioning is OPT-IN: the `--login`/`--auth` command (only when you explicitly run it) collects
  your email + password and transmits them to compliancehub.cn's official auth endpoints
  (/api/v1/auth/register, /api/v1/auth/login) to create your account, then mints a free API Key via
  /api/v1/auth/keys. On success the Key is written to ~/.config/compliancehub/gdpr-check.key (mode 0600).
  🌐 Language: bilingual (中文/English). Guidance and recommendations default to Chinese for Chinese-speaking
  compliance teams; legal/regulatory terms keep English originals. Users may request English output at any time.
Confidence
60% confidence
Finding
create your account, then mints a free API Key via /api/v1/auth/keys. On success the Key is written to ~/.config/compliancehub/gdpr-check.key (mode 0600). 🌐 Language: bilingual (中文/English). Guida

Session Persistence

Medium
Category
Rogue Agent
Content
about your compliance status persists across sessions unless you explicitly opt in with `--login`.
- **Account credentials (ONLY on explicit `--login`):** Only when you explicitly run `--login`/`--auth` does
  the skill prompt for your email + password and POST them to compliancehub.cn's official auth endpoints
  (/api/v1/auth/register, /api/v1/auth/login) to create your account, then mints a free API Key via
  /api/v1/auth/keys. This is a manual, one-time opt-in.
- **Where data goes:** Check items are fetched from, and your answers are scored by, the CQDev cloud at
  `https://compliancehub.cn` (the operator's official endpoint). Scoring transmits only your item answers and the free API Key (as a Bearer token).
Confidence
60% confidence
Finding
create your account, then mints a free API Key via /api/v1/auth/keys. This is a manual, one-time opt-in. - **Where data goes:** Check items are fetched from, and your answers are scored by, the CQDe

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.