ClawHub

Toutiao Article Details API

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do the claimed API lookup, but it handles the required API token in ways that can expose it in local process lists and URL logs.

Install only if you are comfortable using a JustOneAPI token with this wrapper. Prefer a revised version that reads the token from the environment or stdin and uses header-based authentication; if the upstream API requires query tokens, keep logs redacted and rotate the token if it may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill requires an authentication token to be sent as a query parameter, which is commonly logged by client tooling, proxies, browser/history mechanisms, and upstream servers. Even though the request uses HTTPS, placing secrets in the URL increases the chance of accidental disclosure and replay if logs or error traces are exposed.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The API requires an authentication token to be sent as a query parameter, which is dangerous because query strings are commonly logged by clients, proxies, gateways, browser histories, and monitoring systems. This increases the risk of credential exposure and token replay, especially since the manifest provides no warning or mitigation guidance to users or downstream systems.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal