ClawHub
Back to skill

Security audit

Endpoints

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Endpoints API toolkit, but it can upload documents and immediately delete remote endpoint data without built-in confirmation safeguards.

Install only if you trust the publisher and endpoints.work. Use it only with files and text you intend to send to the external API, verify the API URL before use, keep the API key private, require an explicit confirmation with the exact endpoint path or item ID before any delete operation, and clean up results/ after processing sensitive documents.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill requires environment secrets and network access but does not declare permissions, which weakens transparency and informed consent around what the skill can access. In a skill that handles API keys and remote document operations, undeclared capabilities increase the risk of silent data access or exfiltration if the skill is invoked unexpectedly.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented behavior expands beyond the declared purpose by including item deletion, arbitrary text scanning, and automatic local persistence of API results. This mismatch is dangerous because users or orchestrators may authorize a seemingly narrow document toolkit while the skill can perform destructive actions and write potentially sensitive extracted data to disk without clear expectation.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The code exposes deletion of individual items through deleteItem(), but the skill manifest description does not disclose this destructive capability. In an agent/tooling context, undocumented destructive actions increase the chance that the capability is invoked without the user's informed consent or appropriate policy gating.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The examples map vague phrases like 'Delete the old endpoint' and especially 'Remove that item' directly to destructive functions. Broad triggers increase the chance of accidental deletion from ambiguous conversational input, which is more dangerous here because the API manages persistent endpoint data and associated files.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents delete operations without any confirmation, warning, or recoverability guidance. In this context, endpoint deletion may also remove associated files, so a single mistaken invocation can cause irreversible data loss across document records and metadata.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
deleteEndpoint() performs irreversible deletion of an endpoint and its associated files with no built-in confirmation, dry-run, or user-warning mechanism. In agent-driven workflows, this creates a real risk of accidental or prompt-induced destructive actions that can lead to data loss.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
deleteItem() deletes a single item immediately based only on the provided ID, without any user-facing warning or confirmation. Even though the scope is smaller than endpoint deletion, an agent or caller could still remove important records accidentally or via manipulated instructions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"start": "tsx src/index.ts"
  },
  "dependencies": {
    "dotenv": "^16.3.1"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",
Confidence
96% confidence
Finding
"dotenv": "^16.3.1"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dotenv": "^16.3.1"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.7.0",
    "typescript": "^5.3.2"
  },
Confidence
95% confidence
Finding
"@types/node": "^20.10.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.7.0",
    "typescript": "^5.3.2"
  },
  "keywords": [
Confidence
95% confidence
Finding
"tsx": "^4.7.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.7.0",
    "typescript": "^5.3.2"
  },
  "keywords": [
    "endpoints",
Confidence
95% confidence
Finding
"typescript": "^5.3.2"

Tool Parameter Abuse

High
Category
Tool Misuse
Content
## Items

### DELETE /api/items/{itemId}

Delete a single item from an endpoint by its 8-character ID.
Confidence
80% confidence
Finding
DELETE /api/items/{itemId}

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/src/index.ts:11