Nbnhhsh Skill

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is purpose-aligned; the only notable point is that lookup text is sent to a third-party abbreviation API.

This skill appears safe and narrowly scoped for abbreviation lookup. Before using it, remember that the queried text is sent to lab.magiconch.com, so avoid submitting anything private or sensitive.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Abbreviations or text submitted for lookup may be visible to the external API provider.

Why it was flagged

The skill sends the user's abbreviation text to a third-party API. This is disclosed and central to the translation function, but users should know their query leaves the local environment.

Skill content

curl -s -X POST "https://lab.magiconch.com/api/nbnhhsh/guess" ... -d '{"text":"abbreviation to query"}'

Recommendation

Use it for intended abbreviation lookups and avoid sending private or sensitive text.