ClawHub

IMDb Extended Details API

Security checks across malware telemetry and agentic risk

Overview

This skill appears to only perform the advertised IMDb details lookup through JustOneAPI, with a real but disclosed token-handling caution.

Install only if you trust JustOneAPI and the publisher with your JUST_ONE_API_TOKEN. Treat the token as sensitive, prefer a limited or easily rotated token if available, and rotate it if URLs, command lines, or logs may have captured it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill defines the authentication token as a required query parameter and later appends all query parameters directly to the request URL. Tokens in URLs are commonly exposed through logs, browser/history tooling, proxies, analytics, and error messages, so this creates unnecessary credential leakage risk even when HTTPS is used.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The API requires an authentication token to be sent in the URL query string, which is a genuine credential-handling weakness. Query parameters are commonly exposed in browser history, intermediary logs, analytics systems, reverse proxies, and referrer data, so a leaked token could allow unauthorized access to the JustOneAPI account or its data. In this skill context, the risk is somewhat elevated because the schema explicitly encourages this pattern and provides no warning or safer alternative.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal