ClawHub
Back to skill

Security audit

Auto Parts OE Inquiry - 汽车配件OE信息查询

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward auto-parts lookup skill that uses a declared JisuAPI key to query documented parts endpoints, with no hidden persistence or unrelated behavior found.

Install only if you are comfortable sending part numbers, brand IDs, parts IDs, and your JisuAPI key to JisuAPI for lookups. Use a dedicated API key with limited quota where possible, and ensure the Python requests dependency is installed from a trusted source.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
82% confidence
Finding
The invocation description says to use the skill for this question type 'or similar automotive OE parts questions,' which is overly broad and can cause the agent to invoke the skill for loosely related user requests. Overbroad routing is dangerous because it may send user-provided part numbers, vehicle details, or related queries to an external API when the user did not explicitly intend third-party processing.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation instructs operators to obtain an API key and use a third-party API but does not warn that user queries and part lookup parameters may be transmitted to JisuAPI. This omission undermines informed consent and privacy expectations, especially because automotive parts queries can include identifiers tied to vehicles, maintenance history, or commercial inventory workflows.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.