ClawHub
Back to skill

Security audit

Curl Http

Security checks for vulnerabilities and agentic risk

Overview

This is a curl command reference skill with no executable installer or hidden automation, though users should handle credentials, cookies, downloads, and trace files carefully when applying the examples.

Install is reasonable if you want a curl command cheat sheet. When using the examples, avoid putting real passwords or tokens directly in commands where they may enter shell history, treat cookie and trace files as sensitive, delete them when finished, and inspect downloaded files before opening or sharing them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The authentication examples include bearer tokens, API keys, basic-auth credentials, and cookies in command lines without warning that such values can be exposed through shell history, process listings, logs, and screenshots. In a copy-paste oriented skill, users may substitute real secrets directly into these patterns and inadvertently leak credentials.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The cookie examples save and reload session state from cookies.txt but do not warn that persisted cookies may function as active authentication tokens. Users may leave these files on disk with weak permissions, commit them accidentally, or reuse them unsafely across contexts.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The file transfer and tracing examples write server content and request traces to local files without warning that downloaded files may be untrusted and trace output can capture headers, cookies, and other sensitive data. This can lead to credential leakage or unsafe handling of untrusted content in operator environments.

Static analysis

No suspicious patterns detected.