ClawHub
Back to skill

Security audit

Api Bridge

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only API scaffolding skill, but generated integrations may use real credentials and call third-party APIs.

Before using generated code, review every exposed endpoint, remove unnecessary write/delete actions, use least-privilege test credentials, and avoid pasting secrets or private API specs unless you trust the environment and target service.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation criteria are broad enough to trigger on common phrases like 'connect to this API' or mentions of 'API key', which can cause the skill to activate in situations where the user did not clearly consent to API scaffolding or external integration work. In this context, overbroad activation increases the chance of unnecessary external-data workflows and credential-related guidance being introduced into ordinary conversations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill describes fetching specs, handling authentication, and producing ready-to-use integration code without warning users that data, endpoint details, and credentials may be sent to third-party services. In an API-integration skill, omission of such warnings is risky because users may provide sensitive tokens, internal URLs, or proprietary schemas without understanding the exposure.

Static analysis

No suspicious patterns detected.