ClawHub
Back to skill

Security audit

Use undici for HTTP requests, fetch, connection pooling, proxies, Mock testing, interceptors, caching.

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only undici HTTP client skill whose network, proxy, and dispatcher examples match its stated purpose.

Review before installing if your environment restricts outbound network access. Prefer local dispatchers when possible, avoid hardcoding proxy credentials, and pin or audit the undici package according to your normal dependency policy.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger scenario is broad enough to invoke this skill for generic HTTP- or fetch-related requests, which can cause the agent to select a network-capable skill in situations where external access was not the user's clear intent. In an agent environment, over-invocation of network tooling increases the chance of unnecessary outbound requests, data exfiltration, or surprising side effects.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The skill documents how to perform real HTTP requests, proxying, and global dispatcher changes, but it does not clearly warn that using the skill may initiate outbound network connections to external systems. In agent settings, the absence of an explicit warning can lead to users or higher-level planners overlooking privacy, compliance, or SSRF-style risks associated with network access.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.