ClawHub
Back to skill

Security audit

tsy-gzh-find-topic

Security checks across malware telemetry and agentic risk

Overview

This is a narrow API wrapper that fetches topic recommendations, but users should understand that it sends an API key to the configured backend.

Install only if you trust the configured TSY_API_URL or the default api.tangshiye.cn service. Keep TSY_API_KEY private, be aware it is sent in the URL query string, and avoid using this skill in environments where request URLs are broadly logged or shared.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs sending the API credential as a query parameter (`apikey={SATOKEN}`) in the request URL. Secrets in URLs are commonly exposed via logs, proxies, browser/history tooling, monitoring systems, and error reports, making unintended credential disclosure more likely even when HTTPS is used. The skill context increases risk because it automatically sources the secret from `.env` and provides no warning or safer alternative.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.