ClawHub
Back to skill

Security audit

Social Media API

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward JustOneAPI social media search wrapper, but users should know their searches and token are sent to JustOneAPI.

Install only if you are comfortable sending social media search terms, filters, time ranges, and your JustOneAPI token to JustOneAPI. Avoid sensitive, regulated, or confidential monitoring queries unless authorized, and prefer a limited-scope or revocable token if the provider supports it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill directs the agent to send user-supplied search terms and filters to a third-party API but does not warn that those values may contain sensitive personal, corporate, or investigative data. In a social-media search context, keywords and time ranges can reveal private interests, targets, or monitoring activity, so omission of a disclosure meaningfully increases privacy and data-handling risk.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The skill manifest is broadly described as analyzing social media workflows and cross-platform search, but it does not define clear invocation boundaries, allowed use cases, or sensitive-query restrictions. In an agent setting, this can cause over-broad triggering and unintended transmission of user-supplied search terms to an external service, increasing privacy and misuse risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The operation sends both user search queries and an access token to a third-party API, yet the manifest provides no user-facing disclosure that prompts may be shared externally. This is dangerous because users may unknowingly expose sensitive research terms, personal information, or proprietary monitoring interests to the external provider.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.