ClawHub
Back to skill

Security audit

小O的赚钱工具箱

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a disclosed live-data monitor that calls a public UUMit API and references a logged-in ClawHub account, with no evidence of hidden exfiltration or destructive behavior.

Before installing, confirm you are comfortable with the skill contacting api.uumit.com from the frontend and with any use of the logged-in @cx75227-ops ClawHub account context. Avoid using it with private account data unless the API calls and browser credential behavior are clear.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
## 数据源

- **UUMit API**: `https://api.uumit.com/api/v1/digital-assets`
- **ClawHub**: 使用已登录的 `@cx75227-ops` 账户
- 网页前端直接通过UUMit公开API获取实时数据
Confidence
85% confidence
Finding
The skill declares that the frontend directly retrieves live data from an external API and also references use of a logged-in account, which creates a real external data transmission and trust boundary. In this context, the skill appears designed to monitor account-linked monetization assets and balances, so sending requests to a third-party service could expose account activity, metadata, or authenticated session context if not tightly scoped and isolated.

Static analysis

No suspicious patterns detected.