ClawHub
Back to skill

Security audit

Tutorial Docs

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a documentation/tutorial skill with a weak API-key example, not hidden or malicious behavior.

Before installing or using this skill, treat the weather API key example as unsafe for real projects. Store keys in environment variables or an ignored local secrets file, and avoid committing API keys to source control.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The tutorial explicitly warns users to keep the API key secret, but then instructs them to paste the key directly into source code. This normalizes insecure credential handling and increases the chance the key will be committed to version control, shared in screenshots, or leaked through source distribution.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
The sample code embeds the API key directly in JavaScript source and does not show any safer storage practice. In a beginner tutorial, this is especially risky because readers are likely to copy the pattern into real projects, causing credential exposure and possible unauthorized API use.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.