Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language ClawHub API documentation skill with manual examples, including account-affecting API calls, but no hidden execution or persistence.
Install this if you want Chinese ClawHub API reference material. Only run POST, DELETE, transfer, merge, rename, or admin examples when you intend to change ClawHub account or package state, verify the target slug or package name first, and keep API tokens scoped and stored outside source code.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /api/v1/skills/{slug}
认证: 需要Bearer Token
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /api/v1/packages/{name}
认证: 需要Bearer Token
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"payload": ("payload.json", open("payload.json", "rb")), "files": ("skill.zip", open("skill.zip", "rb")) } response = requests.post("https://clawhub.ai/api/v1/skills", headers=headers, files=files) print(response.json())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"payload": ("payload.json", open("payload.json", "rb")), "files": ("skill.zip", open("skill.zip", "rb")) } response = requests.post("https://clawhub.ai/api/v1/skills", headers=headers, files=files) print(response.json())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"payload": ("payload.json", open("payload.json", "rb")), "files": ("skill.zip", open("skill.zip", "rb")) } response = requests.post("https://clawhub.ai/api/v1/skills", headers=headers, files=files) print(response.json())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"payload": ("payload.json", open("payload.json", "rb")), "files": ("skill.zip", open("skill.zip", "rb")) } response = requests.post("https://clawhub.ai/api/v1/skills", headers=headers, files=files) print(response.json())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"payload": ("payload.json", open("payload.json", "rb")), "files": ("skill.zip", open("skill.zip", "rb")) } response = requests.post("https://clawhub.ai/api/v1/skills", headers=headers, files=files) print(response.json())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"payload": ("payload.json", open("payload.json", "rb")), "files": ("skill.zip", open("skill.zip", "rb")) } response = requests.post("https://clawhub.ai/api/v1/skills", headers=headers, files=files) print(response.json())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"payload": ("payload.json", open("payload.json", "rb")), "files": ("skill.zip", open("skill.zip", "rb")) } response = requests.post("https://clawhub.ai/api/v1/skills", headers=headers, files=files) print(response.json())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"payload": ("payload.json", open("payload.json", "rb")), "files": ("skill.zip", open("skill.zip", "rb")) } response = requests.post("https://clawhub.ai/api/v1/skills", headers=headers, files=files) print(response.json())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"payload": ("payload.json", open("payload.json", "rb")), "files": ("skill.zip", open("skill.zip", "rb")) } response = requests.post("https://clawhub.ai/api/v1/skills", headers=headers, files=files) print(response.json())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"payload": ("payload.json", open("payload.json", "rb")), "files": ("skill.zip", open("skill.zip", "rb")) } response = requests.post("https://clawhub.ai/api/v1/skills", headers=headers, files=files) print(response.json())
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"payload": ("payload.json", open("payload.json", "rb")), "files": ("skill.zip", open("skill.zip", "rb")) } response = requests.post("https://clawhub.ai/api/v1/skills", headers=headers, files=files) print(response.json())
This markdown file documents a soft-delete operation for skills and provides ready-to-run cURL/Python examples, but it does not include any caution that invoking the endpoint will hide or deactivate the targeted skill. For markdown files, destructive behaviors that can affect user data or system state should include an explicit warning so users understand the impact before copying the example.
The section documents a package soft-delete API and includes executable examples, but it does not warn readers that calling it will remove package visibility or availability until restored. Because this is a markdown description of a destructive operation affecting published assets, an explicit caution is expected.
The skill content is entirely in Chinese and does not provide a language choice, translation, or documented locale restriction. This can prevent many users and reviewers from understanding important API usage, authentication, and safety guidance, increasing the risk of misuse, misconfiguration, or missed warnings due to lack of accessibility rather than direct code execution risk.
The entire API reference is presented only in Chinese, with no indication that alternate language/localization is available or that the locale restriction is intentional for a region-specific audience. Under the policy, forcing a specific language without user opt-in or clear justification can be a natural-language policy violation.
The markdown file begins with a Chinese-only title, indicating the skill documentation is presented in a specific language without any visible opt-in, alternative language option, or justification for a locale-specific audience. Under the policy rules, forcing a specific language without user choice can be a natural-language policy violation.
This markdown file presents all explanatory text in Chinese, which can be interpreted as forcing a specific language for users without any visible opt-in or justification. The policy requires either offering a language/locale choice or clearly documenting why a locale restriction is necessary.
No suspicious patterns detected.