ClawHub
Back to skill

Security audit

http-retry

Security checks across malware telemetry and agentic risk

Overview

This is a small instructional HTTP retry skill, with the main risk being that copied retry code should be used carefully for actions that change data.

Reasonable to install as an HTTP retry reference. When applying the code, default retries to idempotent requests, use idempotency keys for operations that change data, respect service retry guidance such as Retry-After, and cap retries to avoid duplicate actions or retry storms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
86% confidence
Finding
The skill recommends automatic HTTP retries but does not warn that retrying non-idempotent requests can duplicate side effects such as purchases, writes, or form submissions. In an agent context, this can cause unintended repeated actions against external services, especially when timeouts occur after the remote system already processed the request.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.