ClawHub
Back to skill

Security audit

TopoLift: Negotiation Skill

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent TopoLift API guide, but users should review it because it teaches agents to send negotiation details to a paid third-party service and describes autonomous crypto payments without spending controls.

Install only if you are comfortable sending negotiation scenarios and pricing strategy to TopoLift. Do not enable x402 payments for an autonomous agent unless you enforce per-call approval, a strict spend cap, and a limited-balance wallet. If using MCP, verify the external topolift-mcp package before running it with an API key.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs agents to send negotiation scenarios to a third-party API and later describes payment-bearing requests, but it does not warn that potentially sensitive business, pricing, and strategy data will leave the local environment. In an agent-skill context, this omission is material because users may assume the skill is purely local documentation when it actually normalizes remote transmission of confidential negotiation content.

External Transmission

Medium
Category
Data Exfiltration
Content
## What TopoLift returns

Every call to `POST https://api.topolift.ai/v1/negotiate` returns a
**bilingual** response:

- A typed `topology` object: `regime`, `load_bearing_strategies[]`,
Confidence
94% confidence
Finding
https://api.topolift.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
### 2. Direct API with a Bearer key

```bash
curl -X POST https://api.topolift.ai/v1/negotiate \
  -H "Authorization: Bearer tl-..." \
  -H "Content-Type: application/json" \
  -d '{
Confidence
97% confidence
Finding
https://api.topolift.ai/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.