ClawHub
Back to skill

Security audit

Veto Approval (Human-in-the-Loop)

Security checks across malware telemetry and agentic risk

Overview

This skill does what it advertises: it sends approval requests to VetoAPI and waits for a human approve/reject decision before continuing.

Install only if you are comfortable sending approval details, approver email addresses, and any provided context to VetoAPI. Avoid putting secrets or regulated data in the action title or context, protect the VETO_API_KEY, and consider adding timeouts and pinned dependencies before production use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill requires access to an environment variable (`VETO_API_KEY`) and sends approval requests over the network, but it does not declare these capabilities in its metadata. This creates a transparency and governance gap: agents or platforms may invoke the skill without realizing it can exfiltrate data to an external service or depend on sensitive secrets.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.