ClawHub
Back to skill

Security audit

圆周率查询 - 即刻数据

Security checks across malware telemetry and agentic risk

Overview

This is a small pi lookup skill that uses a Jike API key and external API calls as disclosed, with minor documentation and credential-handling cautions.

Install this only if you intend to use Jike's pi lookup API and are comfortable providing a JIKE_PI_QUERY_KEY. Use it for pi digit and digit-sequence lookups, avoid treating it as a date or market-data skill, and do not set JIKE_API_BASE_URL to an endpoint you do not trust.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares runtime requirements and documents use of environment variables and an external API, but does not declare explicit permissions for environment access, file/script execution, and network use. This creates a transparency and policy-enforcement gap: hosts or users may not realize the skill can read secrets and transmit data externally, increasing the risk of unintended secret exposure or unauthorized outbound requests.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The skill description advertises overly broad activation scenarios unrelated to π lookup, which can cause an agent to invoke this skill for irrelevant user requests. In an agentic system, over-broad routing increases the chance of unnecessary external API calls and transmission of user prompts or parameters to a third party without clear need.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The AppKey is appended to the URL query string, which can be logged by proxies, web servers, monitoring tools, shell history, or exception traces. Even over HTTPS, query parameters are more likely to leak through operational logging than credentials sent in headers or POST bodies.

External Transmission

Medium
Category
Data Exfiltration
Content
直接调用 API：

```text
GET https://api.jikeapi.cn/v1/pi/find_number?appkey=YOUR_APPKEY
```

## AI 使用步骤
Confidence
89% confidence
Finding
https://api.jikeapi.cn/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.