ClawHub
Back to skill

Security audit

Yapi

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent YApi documentation helper; its CLI use, local config lookup, and sync file writes fit that purpose when used intentionally.

Install only if you intend to let the agent use your configured YApi CLI or the @leeguoo/yapi-mcp npm package. Review the npm package source and token scope if this is a sensitive YApi instance, run docs-sync with --dry-run first, and inspect generated .yapi changes before committing them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
86% confidence
Finding
The skill instructs the agent to run docs-sync operations that create and update local files such as `.yapi/docs-sync.json` and related mapping outputs, but it does not explicitly warn that these commands modify the workspace. In an agent setting, undisclosed file writes can surprise users, overwrite repo state, or introduce unintended artifacts, especially when transitioning from `--dry-run` to a real sync.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.