ClawHub
Back to skill

Security audit

Cubox Integration (International & China)

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it claims: save user-selected URLs and memos to Cubox using a user-provided API URL.

Install this only if you want your agent to save selected URLs or memo text to Cubox. Treat CUBOX_API_URL like a password, verify it points to your Cubox API endpoint, and avoid sending confidential content unless you are comfortable storing it in Cubox.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill explicitly requires access to an environment variable containing a private Cubox API URL and performs outbound network calls, but the metadata does not declare those capabilities. Undeclared env/network access reduces transparency and permission scoping, which can cause users or agent frameworks to expose sensitive credentials or allow external communication without informed approval.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.