ClawHub
Back to skill

Security audit

Pinax API

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only API helper whose token use is expected for querying the Pinax API.

Before installing, treat any Bearer token or API key as a secret: only send it to the intended Pinax API over HTTPS, avoid logging or sharing it, and rotate it if exposed. The skill otherwise appears scoped to API documentation and request construction.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
90% confidence
Finding
The skill instructs agents to use Bearer tokens or API keys with an external API but does not explicitly warn that these credentials are sensitive and should only be sent to the trusted Pinax domain over HTTPS. In an agent setting, omission of credential-handling guidance can increase the risk of accidental token disclosure, misuse in logs, or forwarding secrets to attacker-controlled endpoints if the base URL is ever substituted or inferred incorrectly.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.