ClawHub
Back to skill

Security audit

heyi-paid-api

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed paid API helper that sends user-approved requests to Heyi and includes a plainly documented local installer, with no evidence of hidden exfiltration or destructive behavior.

Install only if you intend to use Heyi's paid external API service. Configure the API key through a credential store or HEYI_API_KEY, review charges before approving billable calls, and be aware that search terms, IDs, and request bodies you authorize will be sent to Heyi-controlled servers. Use dry-run or explicit agent selection if you do not want the installer to copy the skill into every detected agent directory.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
72% confidence
Finding
The skill declares no explicit permissions even though its documented usage clearly involves reading environment variables, reading local files, and invoking shell/HTTP tooling. That mismatch can bypass user expectations and safety controls, increasing the chance that a host agent grants powerful capabilities without transparent disclosure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
83% confidence
Finding
The documented purpose is limited to calling Heyi content APIs, but the broader described behavior includes local installation, file copying/overwrites, snapshot generation, catalog diffing, and package publishing with other tokens. This capability mismatch is dangerous because users may authorize what appears to be a simple API-calling skill while it also performs higher-risk local and supply-chain actions.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger list contains broad phrases such as '视频解析', '内容数据接口', and '社媒 API' that can match general user requests outside the narrowly intended paid Heyi API workflow. In this skill context, overbroad activation is dangerous because it may cause the agent to invoke an external paid service, transmit user-supplied data, or encourage use of a Bearer API key when the user only asked for generic content analysis or social-media help.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The submission text advertises a paid external API that uses a Bearer API key and performs billing-related operations, but it does not prominently warn about charges, external data transfer, or the sensitivity of submitted content. In this context, that omission increases the risk of unintended spending, secret exposure, and privacy harm because the skill is specifically designed to send requests to third-party infrastructure.

External Transmission

Medium
Category
Data Exfiltration
Content
call_record_ref:
    note: 服务端积分流水条目指针，用于事后对账
dependencies:
  - curl 或任意 HTTP 客户端
  - Node.js >= 14（仅 check / snapshot 命令需要）
  - 有效 API Key（注册赠送 50 点；填邀请码双方各 +10）
---
Confidence
80% confidence
Finding
This skill is explicitly designed to transmit user-supplied queries and authenticated requests to an external third-party API service. External transmission is expected in context, but it still carries real security risk because prompts, identifiers, and returned data may leave the local trust boundary and incur paid actions.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
README.md:155