ClawHub
Back to skill

Security audit

fto-report-quality

Security checks across malware telemetry and agentic risk

Overview

This skill is an FTO report reviewer, but its advertised legal-quality safeguards do not match the shipped scripts closely enough for users to rely on it without review.

Review this skill before installing for production legal-risk work. It appears non-destructive, but treat its output as a draft quality checklist, not as a verified FTO assurance report, unless the advertised v9.0 controls and recall calculations are fixed and tested. Avoid sending confidential product or patent materials through the external MCP unless the account, data handling, and authorization scope are acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill promises significant assurance features—five-track search, Jackknife recall estimation, fatal-defect vetoes, summary-priority mode, and logic validation—but the implementation reportedly omits or downgrades many of them. In a legal-risk review workflow, this can mislead users into overtrusting report completeness and quality gates, causing unsafe business or legal decisions based on controls that do not actually exist.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The overlap calculation is incorrect because the code builds the independent pool using patent_number/no, but later computes overlap from p['patent_no'], which independent_pool entries generally do not contain. This can force overlap_count to zero or undercount overlaps, producing inaccurate Chapman recall estimates and omission lists in a legal-risk review workflow, potentially causing users to trust a flawed FTO quality assessment.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.