ClawHub
Back to skill

Security audit

Score Analysis Publish

Security checks across malware telemetry and agentic risk

Overview

This skill appears useful and coherent, but it should be reviewed because it works with student grades and saves reports without clear privacy or retention guidance.

Use only with authorization to handle the student records involved. Prefer de-identified inputs where possible, restrict access to generated JSON/charts/reports, avoid sharing exported reports broadly, and delete outputs when they are no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README instructs users to provide and analyze student score data but does not warn that this information may contain personal or educational records requiring careful handling. In a school context, grades, rankings, and student identifiers are sensitive data, so omission of privacy guidance can lead to inappropriate collection, sharing, storage, or report generation that exposes student information.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill is designed to process student performance data, names, class information, rankings, and generate persistent output files, yet the description provides no privacy, retention, access-control, or handling guidance. In an education context this is sensitive personal data, so omission of data-handling safeguards increases the risk of unauthorized disclosure through saved JSON, charts, Word reports, or downstream skill integrations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.