ClawHub
Back to skill

Security audit

Quick API

Security checks across malware telemetry and agentic risk

Overview

This is a small API-testing helper with credential-bearing examples that require care, but the artifacts do not show automatic execution or malicious behavior.

Install only if you want curl-style API testing snippets. Treat every command as a template: verify the domain before sending tokens or passwords, prefer scoped or test credentials, avoid inline basic auth with real passwords, and do not use the hidden OADP/onlyflies.buzz endpoints unless you intentionally want to interact with that service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill includes authenticated curl examples using bearer tokens, API keys, and basic auth, but provides no warning that these commands transmit credentials to external services and may expose secrets in shell history, logs, or to unintended endpoints. In an agent skill context, this increases the risk of users or downstream agents sending real credentials to arbitrary URLs without adequate verification.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth Patterns
```bash
# Bearer token
curl -s -H "Authorization: Bearer $TOKEN" "https://api.example.com/protected"

# API key header
curl -s -H "X-API-Key: $KEY" "https://api.example.com/data"
Confidence
94% confidence
Finding
This example sends a bearer token in an Authorization header to an external endpoint without any surrounding warning or trust-verification guidance. In a skill designed for rapid use, this can normalize sending real secrets to arbitrary hosts, creating risk of credential leakage or misuse if the endpoint is mistyped, malicious, or user-supplied.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -s -H "Authorization: Bearer $TOKEN" "https://api.example.com/protected"

# API key header
curl -s -H "X-API-Key: $KEY" "https://api.example.com/data"

# Basic auth
curl -s -u "user:pass" "https://api.example.com/data"
Confidence
94% confidence
Finding
The API-key example encourages transmitting a sensitive credential to an external service but omits any safety guidance about endpoint validation, scope limitation, or secret handling. In practice, this can lead to accidental disclosure of production keys to untrusted or incorrect services.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -s -H "X-API-Key: $KEY" "https://api.example.com/data"

# Basic auth
curl -s -u "user:pass" "https://api.example.com/data"
```

## Batch Test
Confidence
97% confidence
Finding
The basic-auth example includes inline credentials and demonstrates sending them to an external endpoint, which is especially risky because inline usernames/passwords are easily exposed in shell history, process listings, transcripts, and logs. Even though the domain is a placeholder, the pattern normalizes an unsafe practice in a tool meant for quick execution.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal