ClawHub
Back to skill

Security audit

Clean HTTP Toolkit

Security checks across malware telemetry and agentic risk

Overview

This is a coherent HTTP utility skill with user-directed network, file, and local-server behavior; the main risk is an explicitly opt-in insecure TLS mode.

Install is reasonable for users who want a lightweight HTTP toolkit. Avoid using --insecure except for controlled testing, be careful when sending bearer/basic credentials or mutating API requests, and do not bind the server to public interfaces unless you intend to expose it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The tool supports an --insecure mode that disables certificate validation and hostname checking, which enables man-in-the-middle attacks against HTTPS downloads. In this skill’s context, that is especially relevant because the script is intended to fetch datasets, models, and attachments for AI agents, so a tampered download could directly poison downstream processing or introduce malicious artifacts.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/_common.py:98

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/download.py:110