ClawHub
Back to skill

Security audit

Synth Data

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Synthdata market-data CLI that uses a disclosed API key to query Synthdata and does not show hidden persistence, destructive behavior, or unrelated data access.

Install only if you are comfortable giving the skill access to a Synthdata API key and sending selected asset tickers to Synthdata. Prefer a revocable key, avoid exposing it in shared terminals or logs, and create any cron, Slack, Telegram, or alert integrations deliberately because those may continue running until disabled.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill requires environment access for an API key and performs outbound network requests, but it does not declare explicit permissions. This creates a transparency and trust problem: users or hosting frameworks may not realize the skill can access secrets and transmit data externally, which increases the risk of unintended secret exposure or policy bypass.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The skill tells users to export an API key but provides no guidance on secure handling, storage, rotation, or avoiding accidental disclosure in logs and shell history. While not an exploit by itself, this omission increases the chance that users mishandle a live credential and expose it to other processes, shared terminals, or support artifacts.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.