ClawHub
Back to skill

Security audit

Avito.ru publish and chat

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Avito API helper, but users should handle its account tokens carefully.

Install only if you are comfortable giving the skill access to your Avito API credentials and account data. Prefer short-lived or least-privileged tokens, avoid running token-bearing commands in shared shells or logged CI jobs, and consider adapting the scripts to read secrets from environment variables, stdin, or a secrets manager.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The script accepts a bearer token as a positional command-line argument, which can expose the credential through shell history, process listings, audit logs, and orchestration tooling. In this skill's context, the token grants access to a real Avito account API, so leakage could allow unauthorized access to account balance and potentially other account-scoped operations if the token is reused more broadly.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script requires an OAuth bearer token to be passed as a command-line argument, which commonly exposes secrets through shell history, process listings, audit logs, and CI job metadata. In the context of an Avito account-management skill, compromise of this token could allow an attacker to read account information and potentially access other account-scoped API operations if the token has broader permissions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script accepts a bearer token as a command-line argument, which can expose the credential through shell history, process listings, audit logs, or job runners. Because this skill manages Avito account messaging data, leakage of the token could allow unauthorized access to private chats and account-scoped API actions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script accepts an OAuth-style bearer token directly as a command-line argument, which can expose the credential through shell history, process listings, job control logs, and audit tooling on multi-user systems. Because this skill manages an Avito account and can access items and messaging-related data, leakage of the token could enable unauthorized account access and API actions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.