ClawHub
Back to skill

Security audit

Public Apis Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local search tool for a bundled public API directory, with only an optional user-run update step that downloads refreshed data from GitHub.

Before installing, note that normal use is local search. Only run the update command if you are comfortable fetching source data from GitHub, and review any third-party API before sending it credentials, API keys, or personal data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (91)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
- 数据库：`apis.json`（本地 JSON 文件，无需联网搜索）

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest description and the entire README content are written in Chinese, with no indication that other languages are supported or that the skill is intentionally restricted to a Chinese-speaking audience. This creates a language/locale policy issue because the skill imposes a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 337)May include surrounding context.

json
},
  {
    "name": "MangaDex",
    "url": "https://api.mangadex.org/docs.html",
    "description": "Manga Database and Community",
    "category": "Anime",
    "auth": "apiKey",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 553)May include surrounding context.

json
},
  {
    "name": "Améthyste",
    "url": "https://api.amethyste.moe/",
    "description": "Generate images for Discord users",
    "category": "Art & Design",
    "auth": "apiKey",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 562)May include surrounding context.

json
},
  {
    "name": "Art Institute of Chicago",
    "url": "https://api.artic.edu/docs/",
    "description": "Art",
    "category": "Art & Design",
    "auth": "No",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 679)May include surrounding context.

json
},
  {
    "name": "Noun Project",
    "url": "http://api.thenounproject.com/index.html",
    "description": "Icons",
    "category": "Art & Design",
    "auth": "OAuth",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 706)May include surrounding context.

json
},
  {
    "name": "Rijksmuseum",
    "url": "https://data.rijksmuseum.nl/object-metadata/api/",
    "description": "RijksMuseum Data",
    "category": "Art & Design",
    "auth": "apiKey",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 1192)May include surrounding context.

json
},
  {
    "name": "ORB Intelligence",
    "url": "https://api.orb-intelligence.com/docs/",
    "description": "Company lookup",
    "category": "Business",
    "auth": "apiKey",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 1534)May include surrounding context.

json
},
  {
    "name": "Imgbb",
    "url": "https://api.imgbb.com/",
    "description": "Simple and quick private image sharing",
    "category": "Cloud Storage & File Sharing",
    "auth": "apiKey",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 1984)May include surrounding context.

json
},
  {
    "name": "CryptoMarket",
    "url": "https://api.exchange.cryptomkt.com/",
    "description": "Cryptocurrencies Trading platform",
    "category": "Cryptocurrency",
    "auth": "apiKey",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 2380)May include surrounding context.

json
},
  {
    "name": "National Bank of Poland",
    "url": "http://api.nbp.pl/en.html",
    "description": "A collection of currency exchange rates (data in XML and JSON)",
    "category": "Currency Exchange",
    "auth": "No",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 2614)May include surrounding context.

json
},
  {
    "name": "CDNJS",
    "url": "https://api.cdnjs.com/libraries/jquery",
    "description": "Library info on CDNJS",
    "category": "Development",
    "auth": "No",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 2713)May include surrounding context.

json
},
  {
    "name": "DomainDb Info",
    "url": "https://api.domainsdb.info/",
    "description": "Domain name search to find all domains containing particular words/phrases/etc",
    "category": "Development",
    "auth": "No",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 2983)May include surrounding context.

json
},
  {
    "name": "import.io",
    "url": "http://api.docs.import.io/",
    "description": "Retrieve structured data from a website or RSS feed",
    "category": "Development",
    "auth": "apiKey",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 3478)May include surrounding context.

json
},
  {
    "name": "StackExchange",
    "url": "https://api.stackexchange.com/",
    "description": "Q&A forum for developers",
    "category": "Development",
    "auth": "OAuth",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 3559)May include surrounding context.

json
},
  {
    "name": "Collins",
    "url": "https://api.collinsdictionary.com/api/v1/documentation/html/",
    "description": "Bilingual Dictionary and Thesaurus Data",
    "category": "Dictionaries",
    "auth": "apiKey",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 3784)May include surrounding context.

json
},
  {
    "name": "Mattermost",
    "url": "https://api.mattermost.com/",
    "description": "An open source platform for developer collaboration",
    "category": "Documents & Productivity",
    "auth": "OAuth",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 3802)May include surrounding context.

json
},
  {
    "name": "Monday",
    "url": "https://api.developer.monday.com/docs",
    "description": "Programmatically access and update data inside a monday.com account",
    "category": "Documents & Productivity",
    "auth": "apiKey",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 4234)May include surrounding context.

json
},
  {
    "name": "National Grid ESO",
    "url": "https://data.nationalgrideso.com/",
    "description": "Open data from Great Britain’s Electricity System Operator",
    "category": "Environment",
    "auth": "No",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 4297)May include surrounding context.

json
},
  {
    "name": "Website Carbon",
    "url": "https://api.websitecarbon.com/",
    "description": "API to estimate the carbon footprint of loading web pages",
    "category": "Environment",
    "auth": "No",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 4702)May include surrounding context.

json
},
  {
    "name": "YNAB",
    "url": "https://api.youneedabudget.com/",
    "description": "Budgeting & Planning",
    "category": "Finance",
    "auth": "OAuth",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 5233)May include surrounding context.

json
},
  {
    "name": "FunTranslations",
    "url": "https://api.funtranslations.com/",
    "description": "Translate Text into funny languages",
    "category": "Games & Comics",
    "auth": "No",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 5350)May include surrounding context.

json
},
  {
    "name": "Hypixel",
    "url": "https://api.hypixel.net/",
    "description": "Hypixel player stats",
    "category": "Games & Comics",
    "auth": "apiKey",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · apis.json (reported line 5953)May include surrounding context.

json
},
  {
    "name": "GeoApi",
    "url": "https://api.gouv.fr/api/geoapi.html",
    "description": "French geographical data",
    "category": "Geocoding",
    "auth": "No",

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
apis.json:12073