ClawHub

Sendbl

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Sendbl file-transfer skill, but users should treat its API key, owner tokens, and generated links as sensitive.

Install only if you are comfortable giving the assistant a Sendbl personal access token. Keep SENDBL_API_KEY, owner_token values, upload URLs, and download URLs private; review filenames, recipients, and deletion requests before approving actions; revoke or rotate tokens if exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
Requires the `owner_token` from step 1 (or 2).

```sh
curl -sS "https://api.sendbl.com/v1/uploadedFiles?token=<owner_token>&limit=50"
```

Returns the array of files with `file_id` and `filename`. To get a download URL for one of them:
Confidence
78% confidence
Finding
https://api.sendbl.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Returns the array of files with `file_id` and `filename`. To get a download URL for one of them:

```sh
curl -sS "https://api.sendbl.com/v1/fileDownloadLink?token=<owner_token>&file_id=<file_id>"
```

### 5. Delete a link
Confidence
81% confidence
Finding
https://api.sendbl.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Requires the `owner_token`. Removes the link **and all uploaded files**.

```sh
curl -sS -X DELETE "https://api.sendbl.com/v1/uploadLink?token=<owner_token>"
```

Confirm with the user before calling — this is irreversible.
Confidence
80% confidence
Finding
https://api.sendbl.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal