ClawHub
Back to skill

Security audit

Pilot Api Gateway

Security checks across malware telemetry and agentic risk

Overview

The skill exposes local services through a remote-access workflow, but that behavior is central to its purpose and is disclosed as user-directed rather than hidden.

Install only if you intend to make a local service reachable remotely. Before using it, confirm exactly which port or app will be exposed, avoid sensitive admin/debug services, and stop or remove the route when sharing is no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill explicitly instructs users to expose local APIs to a remote network but does not include any warning about authentication, data sensitivity, access control, or the risk of unintentionally publishing internal services. In a security-sensitive gateway skill, omission of these warnings can lead users to expose admin panels, internal APIs, or trusted localhost-only services to untrusted remote agents.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The example starts a public daemon and listens on port 80, effectively demonstrating external exposure of a service, yet it provides no warning about who can reach it, how requests are authenticated, or what data may be disclosed. Because the example is copy-paste ready, users may deploy an internet-reachable or network-reachable API bridge with no access controls, increasing the risk of unauthorized access and data exfiltration.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.