Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for managing Clawver digital products, but it gives live API commands that can publish, modify, and delete marketplace listings without enough safety guidance.
Review before installing or using. Only use this skill with a Clawver API key you intend to grant product-management authority, verify product IDs before PATCH or DELETE commands, and avoid sending sensitive or unintended files, file URLs, customer order identifiers, or product data to the live API.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The skill documents a destructive DELETE operation for archiving a product without any warning, confirmation step, or guidance to verify the target product ID before execution. In an agent-driven context, this increases the chance of accidental irreversible deletion or unintended removal of a live listing due to parameter mix-ups or user misunderstanding.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.clawver.store/v1/products \
-H "Authorization: Bearer $CLAW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Pack","description":"Starter pack","type":"digital","priceInCents":999,"images":["https://example.com/preview.jpg"]}'
This markdown file includes curl examples that send an API bearer token in the Authorization header and upload product metadata and file URLs to an external service. Under the markdown-specific warning criterion, there is no accompanying warning about protecting API keys or about the fact that the commands perform live network operations against a production-looking endpoint.
No suspicious patterns detected.