Jrv Http Client
Analysis
This is a coherent curl-like HTTP client, but it gives an agent broad authenticated API access, including mutating requests, and can expose API-key headers in verbose output.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
`GET/POST/PUT/DELETE/PATCH/HEAD` | HTTP method ... `--bearer <token>` ... `--auth <user:pass>` ... `--api-key <Header:value>`
The documented interface allows an agent to send arbitrary authenticated requests, including mutating or destructive methods, to any URL.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
req_headers[hname.strip()] = hval.strip() ... masked = v if "Authorization" not in k else v[:20] + "..."
API keys supplied through custom headers are stored in request headers, but verbose output masks only headers named Authorization, so headers such as X-API-Key can be printed in cleartext.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Supports ... timing, and request history ...
The description advertises request history, but the documentation does not describe what is stored, where it is stored, or how sensitive URLs or request details are excluded.