ClawHub
Back to skill

Security audit

Pordl App Setup

Security checks across malware telemetry and agentic risk

Overview

This skill clearly helps users configure apps to use PORDL as an external model backend, with no hidden execution or persistence beyond user-directed app settings.

Install only if you intend PORDL to process requests from the configured app. For sensitive chats, source code, or workplace data, confirm PORDL is approved for that data before changing the base URL; keep the API key in the app settings or an environment variable, not in chat.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
Any app that supports a custom OpenAI endpoint works with PORDL:

- **Base URL:** `https://api.pordl.dev/v1`
- **API Key:** the user's `pd_live_` key from https://api.pordl.dev (free tier: 100K credits/month, no card required)
- **Model:** `auto` (PORDL picks the best model per request), or any model from `https://api.pordl.dev/v1/models`
Confidence
91% confidence
Finding
https://api.pordl.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
- **Base URL:** `https://api.pordl.dev/v1`
- **API Key:** the user's `pd_live_` key from https://api.pordl.dev (free tier: 100K credits/month, no card required)
- **Model:** `auto` (PORDL picks the best model per request), or any model from `https://api.pordl.dev/v1/models`

## App-Specific Notes
Confidence
91% confidence
Finding
https://api.pordl.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
Settings → Connections → OpenAI API → set the base URL and key above. Models populate automatically.

### LibreChat
Add a custom endpoint in `librechat.yaml` with `baseURL: https://api.pordl.dev/v1` and `apiKey: ${PORDL_API_KEY}`.

### Continue / Cline / Aider (coding assistants)
Configure an OpenAI-compatible provider with the base URL above. For coding, `routing_mode: "balanced"` (the default) sends simple completions to budget models and complex refactors to stronger ones.
Confidence
90% confidence
Finding
https://api.pordl.dev/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.