ClawHub
Back to skill

Security audit

glm

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward RunAPI/GLM integration guide with expected external API use and no hidden execution behavior.

Install only if you intend to use RunAPI for GLM requests. Keep the RunAPI token in environment variables or a secret manager, and do not send secrets, regulated data, or customer content unless your policy allows that data to be processed by RunAPI/GLM.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The examples send both user-supplied prompts and an API credential to a third-party service (RunAPI/GLM) but do not clearly warn users that their input data will leave their environment and be processed externally. In an agent skill context, this omission can cause accidental disclosure of sensitive prompts, proprietary content, or secrets if users assume the operation is local or do not realize the trust boundary change.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.