ClawHub
Back to skill

Security audit

Artificial Analysis Models

Security checks across malware telemetry and agentic risk

Overview

The skill does what it claims, but it ships with a prefilled Feishu table target and can update records there, so users should review the target before running it.

Install only if you intend to create or update a Feishu Bitable model catalog. Before running it, clear or replace the bundled bitable-config.json values, confirm the target Base/table, and use an environment variable or managed secret store instead of a plaintext credential file if your API key handling policy requires it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
export ARTIFICIAL_ANALYSIS_API_KEY="你的key"

# 方式 B：凭证文件（推荐）
mkdir -p ~/.openclaw/credentials
cat > ~/.openclaw/credentials/artificial-analysis.json <<'EOF'
{"api_key": "你的key"}
EOF
Confidence
88% confidence
Finding
mkdir -p ~/.openclaw/credentials cat > ~/.openclaw/credentials/artificial-analysis.json <<'EOF' {"api_key": "你的key"} EOF chmod 600 ~/.openclaw/credentials/artificial-analysis.json ``` 免费 API 限额：**100

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/fetch-llms.mjs:13