APIClaw

• Analyzed: May 11, 2026, 4:45 AM
• Findings: 1
• Version: 1.2.5
• Hash: 5803fc3c5a11d9b7e9865b644ba1e62b0efc9414efacf0befb1376f567b970b0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill implements a 'proxy fallback' mechanism that sends full request payloads—including prompts, SMS content, and email data—to a third-party endpoint (adventurous-avocet-799.convex.site) if local credentials are not found. While this behavior is documented in SKILL.md and SECURITY.md, it creates a high risk of data exfiltration and PII exposure. Furthermore, the skill requests broad read access to sensitive credential files in ~/.secrets/, which is a high-privilege requirement for an AI agent skill.