ClawHub
Back to skill

Security audit

Test Publish Listing

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed cloud API client for generating ecommerce listings, with normal credential and network use for that purpose.

Install only if you are comfortable sending product names, keywords, and related listing details to Yufluent’s service under your TOKENAPI_KEY. Set TOKENAPI_BASE_URL only to the official endpoint you intend to use, protect the tk-* key like a password, and review generated listings before publishing them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tainted flow: 'url' from os.getenv (line 271, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}
    if body is not None:
        kwargs["json"] = body
    return requests.post(url, **kwargs)


def _raise_for_status(resp: requests.Response) -> None:
Confidence
97% confidence
Finding
return requests.post(url, **kwargs)

Missing User Warnings

Low
Confidence
78% confidence
Finding
The README tells users to export and reuse a `tk-*` credential and points to a local API endpoint, but does not warn about protecting secrets from shell history, logs, screenshots, or shared environments. In practice this can lead to accidental credential disclosure, especially because the same token is described as shared across OpenClaw and `run.py`, increasing blast radius if leaked.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
Confidence
97% confidence
Finding
requests>=2.31.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.