ClawHub
Back to skill

Security audit

Yufluentcn Seo Pro

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed cloud SEO-report client that uses a Yufluent API key and user-provided product keywords, with only low-level dependency hygiene issues found.

Before installing, understand that your product details and keyword inputs will be sent to Yufluent's cloud service using TOKENAPI_KEY. Keep that key private, prefer environment variables over committing .env files, and consider pinning or updating requests to a reviewed patched version in controlled deployments.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Credential Access

High
Category
Privilege Escalation
Content
## 快速开始（3 步，60 秒）

1. **注册获取 API 密钥** → https://claw.changzhiai.com/login （新用户即送体验积分，无需绑卡）
2. **设置环境变量**：export TOKENAPI_KEY=*** 或写入 .env 文件
3. **运行**：参照下方 Examples 示例执行 python scripts/run.py ...

> 还没注册？前往 https://claw.changzhiai.com/login 免费获取密钥。
Confidence
60% confidence
Finding
.env

Unpinned Dependencies

Low
Category
Supply Chain
Content
-e ../../packages/tokenapi-sdk
-e ../../packages/tokenapi-harness
requests>=2.31.0
Confidence
97% confidence
Finding
requests>=2.31.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.31.0
Confidence
96% confidence
Finding
requests>=2.31.0

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low
Category
Supply Chain
Confidence
93% confidence
Finding
requests==2.31.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.