ClawHub
Back to skill

Security audit

muapi-platform

Security checks across malware telemetry and agentic risk

Overview

The skill is a small, user-run MuAPI helper that does what it says, though users should handle the API key carefully.

Install the MuAPI CLI only from a trusted MuAPI source, confirm which `muapi` command will run, and avoid passing long-lived API keys directly on the command line. Prefer `bash setup.sh --add-key` without an argument so the CLI can prompt securely, and rotate the key if it may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script accepts an API key as a positional command-line argument and passes it directly to the CLI. Command-line arguments are commonly exposed through shell history, process listings, audit logs, and CI job output, so this can leak long-lived credentials to other local users or logging systems.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.