ClawHub
Back to skill

Security audit

Airnode Hub

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Airnode API discovery and verification helper with network access that fits its stated purpose.

Installers should be comfortable with this skill making outbound HTTPS requests to Airnode Hub and selected Airnode endpoints, and should keep the npm dependency lockfile under controlled update review. The skill explicitly avoids paid calls, private keys, signing, and spending.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Unpinned Dependencies

Low
Category
Supply Chain
Content
"private": true,
  "type": "module",
  "dependencies": {
    "viem": "^2.52.2"
  }
}
Confidence
93% confidence
Finding
The dependency uses a caret range (^2.52.2), which allows future minor and patch releases to be installed. This can introduce supply-chain risk and build non-reproducibility if an upstream release is compromised or unexpectedly changes behavior, even though the file itself shows no overtly malicious intent.

Static analysis

No suspicious patterns detected.