Is 1227323804/sensitive-check-skill safe?
Use with caution. 1227323804/sensitive-check-skill is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the sensitive-check-skill skill by 1227323804 a trust score of 74/100 with 6 findings (1 critical, 1 high).
https://clawhub.ai/1227323804/sensitive-check-skill
Is 1227323804/sensitive-check-skill safe to install?
This skill sends user content to an external Chinese server for 'sensitive content detection' but poses significant privacy and security risks. While it doesn't contain malicious code execution or prompt injection, it exfiltrates user data without adequate transparency or security measures.
What security issues were found in 1227323804/sensitive-check-skill?
Category Scores
Findings (6)
CRITICAL User content sent to external server -60 ▶
The skill sends user-provided content to an external server at safeguard-pre.ucap.com.cn without explicit user consent or transparency about data handling practices.
HIGH SSL verification disabled -15 ▶
The HTTP request to the external server disables SSL certificate verification, making the connection vulnerable to man-in-the-middle attacks.
MEDIUM Data residency and compliance risks -40 ▶
Data is sent to a Chinese server (.com.cn domain) which may violate data residency requirements and compliance policies for organizations with geographic data restrictions.
MEDIUM Lack of transparency -30 ▶
The skill provides no clear privacy policy or explanation of how user data will be processed, stored, or protected by the external service.
LOW External HTTP requests -10 ▶
The skill makes HTTP requests to external servers, which could potentially be used for further malicious purposes.
LOW Unexpected network activity during testing -15 ▶
Network connections were made to the external API server during testing, indicating the skill may operate automatically upon installation.
Should I install 1227323804/sensitive-check-skill?
Oathe's verdict for 1227323804/sensitive-check-skill is CAUTION with a trust score of 74/100. Recommendation: Review before install.