ClawHub

UserLayer

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward paid UserLayer API wrapper, with credential use and costs disclosed, but users should only use a trusted API host.

Install this only if you intend to use a paid UserLayer account. Use a scoped API key, watch the documented per-analysis and query costs, and leave LAUNCHBASE_API_URL at the default unless you specifically trust the alternate endpoint.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tainted flow: 'LAUNCHBASE_API_URL' from os.environ.get (line 9, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}

    try:
        response = requests.post(
            f"{LAUNCHBASE_API_URL}/v1/{service}{endpoint}",
            json=params,
            headers={
Confidence
88% confidence
Finding
response = requests.post( f"{LAUNCHBASE_API_URL}/v1/{service}{endpoint}", json=params, headers={ "Authorization": f"Bearer {api_key}",

Tainted flow: 'LAUNCHBASE_API_URL' from os.environ.get (line 7, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
return {"success": False, "error": "AUTH_NO_API_KEY"}
        
    try:
        response = requests.get(
            f"{LAUNCHBASE_API_URL}/v1/{SERVICE_NAME}/analyze/{analysis_id}/status",
            headers={"Authorization": f"Bearer {api_key}"},
            timeout=30
Confidence
95% confidence
Finding
response = requests.get( f"{LAUNCHBASE_API_URL}/v1/{SERVICE_NAME}/analyze/{analysis_id}/status", headers={"Authorization": f"Bearer {api_key}"}, timeout=30

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal