ClawHub
Back to skill

Security audit

GreenHelix API Mastery Bundle: 22 Hands-On Tutorials

Security checks across malware telemetry and agentic risk

Overview

This bundle does not run code, but it asks for powerful production-style credentials without explaining why each one is needed or how to protect them.

Review before installing. Prefer sandbox or tightly scoped test credentials, do not attach production Stripe or signing keys unless you have verified the specific guide that needs them, and keep secrets out of shared chats, logs, and broad agent context.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The manifest presents this package as a non-executable tutorial bundle, yet it declares multiple high-sensitivity credentials for production systems, including payment and signing keys. That mismatch can mislead operators into supplying real secrets to content that provides no visible justification, increasing the risk of unnecessary credential exposure or unsafe downstream use by included skills.

Vague Triggers

Medium
Confidence
68% confidence
Finding
The description advertises a very broad set of API-heavy production tutorials without defining when the skill should be invoked or what tasks are in scope. Overly broad metadata can cause inappropriate activation in unrelated contexts and increase the chance that users or orchestrators expose sensitive credentials or rely on the bundle beyond its intended purpose.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The manifest explicitly requests sensitive secrets such as a production API key, signing key, Stripe API key, and wallet address, but provides no warning, handling guidance, or indication that test credentials should be used. In a tutorial bundle context, this is dangerous because it normalizes attaching powerful secrets to educational content and raises the likelihood of accidental exposure, misuse, or over-privileged access.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.