ClawHub
Back to skill

Security audit

Curl Http

Security checks across malware telemetry and agentic risk

Overview

This appears to be a straightforward curl reference skill, with some examples users should handle carefully but no evidence of hidden or malicious behavior.

Install only if you want curl command examples. Review commands before running them, avoid placing real secrets directly in command lines or URLs, save downloads to explicit safe paths, and do not use -k/--insecure with sensitive traffic.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill includes examples that write downloaded content to local files and use remote filenames without warning that these commands modify the filesystem and may overwrite or place untrusted content locally. In an agent or copy-paste context, this can lead to unintended data transfer, unsafe file placement, or execution of subsequently trusted downloads.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The authentication section shows credentials, bearer tokens, and API keys being sent via command line and even in URLs without warning about exposure through shell history, process listings, logs, proxies, and server access logs. The URL query-string API key example is especially risky because secrets in URLs are commonly retained in many logging layers.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The `curl -k` example disables certificate validation, which enables man-in-the-middle attacks and defeats TLS authenticity guarantees. Saying only 'not recommended for production' understates the danger, especially if users copy the command into testing environments that still handle real credentials or sensitive data.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.