ClawHub
Back to skill

Security audit

Admapix Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a thin AdMapix API client that makes disclosed external API requests and uses an API key, with no evidence of hidden persistence, destructive behavior, or unrelated data access.

Install only if you intend your agent to query AdMapix. Do not include secrets or unnecessary sensitive business data in search parameters, and keep ADMAPIX_API_KEY in the environment rather than chat. Expect requests to be sent to api.admapix.com and raw API JSON to be returned.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
82% confidence
Finding
The capability coverage section is overly broad and ambiguous, which can cause the agent to activate this skill for loosely related prompts and send user-supplied data to the external AdMapix service unexpectedly. In a skill that has both exec capability and third-party network access, broad triggering increases the chance of unintended data disclosure and misuse.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documentation does not prominently warn that it will perform external network requests and transmit user query parameters to a third-party API. This matters because users may provide sensitive business queries or identifiers without realizing they will leave the local agent environment.

External Transmission

Medium
Category
Data Exfiltration
Content
| curl 或等价 HTTP 客户端 | 命令行工具 | 必需 | 系统自带或包管理器安装 |

### 可用性分类
- **分类**: MD+EXEC（Markdown 指令驱动，需 exec 执行 curl 命令）
- **说明**: 基于自然语言指令驱动 Agent 调用 AdMapix API，透传原始结构化 JSON

## 核心能力
Confidence
89% confidence
Finding
curl 命令） - **说明**: 基于自然语言指令驱动 Agent 调用 AdMapix API，透传原始结构化 JSON ## 核心能力 ### 参数映射 阅读 `references/param-mappings.md` 将自然语言翻译为代码： - 创意类型（`010`=视频等）、行业（`trade_level1`：`602`=游戏，`607`=金融...）、国家/地区分组、相对日

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.