ClawHub
Back to skill

Security audit

60s API 综合技能

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed 60s API lookup helper, but it includes a remote password-check endpoint that could send real passwords to a third party without a clear warning.

Install only if you are comfortable with the agent making external requests to the 60s API service. Do not use the password-check endpoint with real passwords, API keys, tokens, or secrets, and avoid submitting confidential text, private URLs, personal IPs, or sensitive domains to the utility endpoints.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger conditions are broad enough to match many ordinary requests such as news, weather, translation, IP lookup, and entertainment prompts, which increases the chance the skill activates when the user did not intend to send data to this third-party API. Overbroad activation is dangerous here because the skill explicitly recommends executing external curl requests, so accidental invocation can cause unnecessary third-party disclosure and tool use.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This section documents IP lookup and translation requests that can transmit user-supplied content to an external service, but it does not warn that the data leaves the local environment or reaches a third party. That creates a privacy risk because users may provide sensitive text, identifiers, or addresses without understanding that the skill will forward them externally.

Missing User Warnings

High
Confidence
99% confidence
Finding
The skill offers password strength checking by sending the password directly to a remote API, yet it provides no warning not to use real passwords or secrets. This is high risk because users may unknowingly disclose live credentials to a third party, enabling credential theft, logging exposure, or reuse across systems.

Static analysis

No suspicious patterns detected.