ClawHub
Back to skill

Security audit

Yufluent Clawhub Publish Yufluentcn Compliance Guard

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a legitimate cloud compliance helper, but it automatically falls back from the scoped skill API to a broader agent orchestration endpoint while sending the same business payload and API key.

Install only if you are comfortable sending product, supplier, shipment, tariff, and platform-rule details to the configured Yufluent/OpenClaw service. Keep TOKENAPI_KEY out of source control and logs, and do not set TOKENAPI_BASE_URL to any host you do not fully trust.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Tainted flow: 'url' from os.getenv (line 271, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}
    if body is not None:
        kwargs["json"] = body
    return requests.post(url, **kwargs)


def _raise_for_status(resp: requests.Response) -> None:
Confidence
93% confidence
Finding
return requests.post(url, **kwargs)

Description-Behavior Mismatch

Medium
Confidence
73% confidence
Finding
When the narrow /skills/{id}/run path fails, the client falls back to a more generic /agent/turn orchestration endpoint and builds a free-form user_message that instructs the agent to execute the skill. This expands the effective execution surface beyond the stated compliance-helper run path and may enable unintended behavior, prompt-side data exposure, or policy bypass if the remote orchestrator behaves differently than the dedicated skill endpoint.

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
The code exposes a separate record_outcome function that posts arbitrary payloads to /agent/outcomes, a telemetry-style endpoint not obviously required for a compliance reference helper. In a skill handling trade/compliance inputs, this can lead to unnecessary transmission of sensitive business data or user activity metadata to a secondary service path, increasing privacy and data-governance risk.

Vague Triggers

Medium
Confidence
73% confidence
Finding
The trigger phrases are broad and overlap with common commerce/compliance queries such as certification, tariffs, HS codes, and platform rules. In an agent ecosystem, this can cause the skill to activate more often than intended, increasing the chance of unnecessary data collection or unreviewed external API calls with user-provided business information.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The instructions tell users to set TOKENAPI_KEY via shell export or a .env file but provide no warning about secret exposure risks, such as committing .env to source control or printing environment variables in logs. This can lead to credential leakage even if the skill itself is not overtly malicious.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
The fallback path sends user-supplied payload data to a remote endpoint without any disclosure in this code path that data will leave the local environment. For a compliance/trade helper, payloads may contain product, supplier, shipment, or regulatory details, so silent transmission creates meaningful privacy and confidentiality risk even if the server is legitimate.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.