ClawHub
Back to skill

Security audit

Remote Api

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it helps expose a local API through a public tunnel, but users should only use it for services meant to be reachable from the internet.

Install only if you intentionally want a local API reachable from the public internet. Before running the tunnel, confirm the service does not expose secrets, admin/debug routes, private data, databases, SSH, or unauthenticated write endpoints; add authentication and rate limiting where appropriate, and stop the tunnel when testing is done.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs the agent to expose a locally running API to the public internet and provides shareable external endpoints, but it does not present a clear upfront warning about the privacy, authentication, and attack-surface implications before the exposure steps. This can lead users to unintentionally publish development or internal services that lack hardening, enabling unauthorized access, data leakage, or abuse of unsafe endpoints.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.