ClawHub
Back to skill

Security audit

model-platform-guide

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only guide for model API platforms; it does not install or run code, but users should treat copied examples as calls to external services.

Install only if you want a reference guide for model-platform API integration. Before running any generated examples, use test prompts, keep API keys out of source code, confirm provider privacy and retention policies, and verify current models, prices, and capabilities against official documentation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The file provides copy-pasteable code that sends user prompts to third-party model providers and uses API keys, but it does not warn users that prompt contents leave their environment or explain safe credential handling. In a documentation skill specifically meant to guide API integration, this omission can lead users to inadvertently transmit sensitive data or mishandle secrets.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The document provides runnable examples that send user prompts and API keys to third-party model providers but does not warn that prompt contents will leave the local environment and be processed by external services. In a skill meant to guide API integration, this omission can cause accidental disclosure of sensitive prompts, credentials, or regulated data by users who copy-paste the examples without understanding the data flow.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/openai-migration.md:63