ClawHub
Back to skill

Security audit

PIPL Check - PIPL合规检查

Security checks across malware telemetry and agentic risk

Overview

This PIPL compliance skill is clear about its cloud scoring, API key use, and local config storage, and I did not find hidden or unrelated behavior.

Before installing, be comfortable that scored checks send your yes/no compliance answers, and either a random anonymous trial ID or your API key, to compliancehub.cn. Use the non-interactive preview if you only want to view the check items locally without cloud scoring.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Low
Confidence
87% confidence
Finding
The manifest states 'Locale: zh-CN' and that interaction/prompts are primarily in Chinese, while only noting that English can be provided on demand. This sets a default language constraint that may conflict with organizational language-choice policy unless the user explicitly opts into Chinese first.

Natural-Language Policy Violations

Low
Confidence
86% confidence
Finding
The HTML report hard-codes `lang="zh-CN"` and presents the report title and major user-facing content in Chinese. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative locale or selection mechanism is provided.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
1) env COMPLIANCEHUB_API_KEY (ephemeral, safest)
      2) private store ~/.config/compliancehub/<slug>.key (mode 0600)
    """
    env_key = os.environ.get("COMPLIANCEHUB_API_KEY")
    if env_key and env_key.strip():
        return env_key.strip()
    p = _key_path()
Confidence
70% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.