ClawHub
Back to skill

Security audit

Fx Base

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed shared API helper that sends authenticated requests to Feima’s service and does not show hidden execution, persistence, or destructive behavior.

Install this only if you trust Feima’s API service and the dependent skills that call this helper, because those skills can send request data using your FX_AI_API_KEY. Keep the key private and revoke or rotate it if you no longer use the integration.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
76% confidence
Finding
The skill explicitly requires a sensitive environment variable (`FX_AI_API_KEY`) and discloses that user data is sent to a remote service, but it does not clearly explain whether the API key is also transmitted, how it is used, or any handling/retention expectations. In a base dependency skill that centralizes authentication and outbound requests for other skills, this omission reduces informed consent and can obscure credential exposure to a third-party backend.

Static analysis

No suspicious patterns detected.