ClawHub
Back to skill

Security audit

researching-internet-slang-and-cultural-trends

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Urban Dictionary lookup helper that uses Apify, with the main consideration being that searched terms are sent to an external service.

Install this if you are comfortable sending searched slang, keywords, and possible brand-monitoring terms to Apify and Urban Dictionary infrastructure. Avoid using it for confidential project names, unreleased products, regulated data, or other sensitive internal terminology unless that disclosure is acceptable.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation/trigger description is broad enough that the skill could be invoked for loosely related requests about language, social media, brands, or cultural trends without clear user intent to query Urban Dictionary. That creates a security and privacy risk because it may route user-provided terms, including sensitive brand-monitoring or internal terminology, to an external third-party service unexpectedly.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs use of a third-party API with an authorization token and sends user-supplied keywords off-platform, but it does not prominently warn that data will be transmitted to Apify/Urban Dictionary infrastructure. Users may unknowingly disclose sensitive search terms, brand-monitoring targets, or internal vocabulary to an external provider.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~urbandictionary-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords": ["slay", "rizz", "no cap"], "maxItems": 5}'
Confidence
97% confidence
Finding
This instruction explicitly performs external transmission to Apify using a bearer token and user-provided payload. Any queried keywords, including sensitive or proprietary terms, can leave the local environment and be exposed to a third-party service, making the transmission itself the core security concern.

External Transmission

Medium
Category
Data Exfiltration
Content
### REST API fallback

```bash
curl -X POST "https://api.apify.com/v2/acts/apidojo~urbandictionary-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords": ["slay", "rizz", "no cap"], "maxItems": 5}'
Confidence
97% confidence
Finding
This instruction explicitly performs external transmission to Apify using a bearer token and user-provided payload. Any queried keywords, including sensitive or proprietary terms, can leave the local environment and be exposed to a third-party service, making the transmission itself the core security concern.

Static analysis

No suspicious patterns detected.