ClawHub
Back to skill

Security audit

Admapix

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed thin client for the AdMapix API, with expected third-party queries and no hidden persistence or destructive behavior found.

Install only if you are comfortable sending AdMapix search terms, app IDs, developer IDs, countries, date ranges, and similar research targets to the AdMapix service. Keep ADMAPIX_API_KEY in the environment as instructed, do not paste it into chat, and avoid using the skill for confidential or regulated target lists unless your organization approves that third-party disclosure.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

External Transmission

Medium
Category
Data Exfiltration
Content
| jq | JSON 处理工具 | 可选 | 提升结果可读性 |

### 可用性分类
- **分类**: MD+EXEC（Markdown 指令驱动，需 exec 执行 curl 命令）
- **说明**: 基于自然语言指令驱动 Agent 调用 AdMapix API，透传原始结构化 JSON

## 核心能力
Confidence
96% confidence
Finding
curl 命令） - **说明**: 基于自然语言指令驱动 Agent 调用 AdMapix API，透传原始结构化 JSON ## 核心能力 ### 参数映射 阅读 `references/param-mappings.md` 将自然语言翻译为代码： - 创意类型（`010`=视频等）、行业（`trade_level1`：`602`=游戏，`607`=金融...）、国家/地区分组、相对日

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"keyword":"rpg","countries":["US"],"trade_level1":["602"],"adTypes":["010"],"page":1,"page_size":10}'
# ...
# Step 2: 查看某条创意详情
curl -s "https://api.admapix.com/api/data/content-detail?id=ad_001&related=imagevideo" \
  -H "X-API-Key: ${ADMAPIX_API_KEY}"
# ...
# Step 3: 查看该创意关联的应用
Confidence
95% confidence
Finding
https://api.admapix.com/

External Transmission

Medium
Category
Data Exfiltration
Content
-H "X-API-Key: ${ADMAPIX_API_KEY}"
# ...
# Step 2: 查询日本免费榜
curl -s -X POST "https://api.admapix.com/api/data/store-rank" \
  -H "X-API-Key: ${ADMAPIX_API_KEY}" -H "Content-Type: application/json" \
  -d '{"countries":["JP"],"rankType":"free","category":"games","page":1,"page_size":20}'
# ...
Confidence
95% confidence
Finding
https://api.admapix.com/

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"countries":["JP"],"rankType":"free","category":"games","page":1,"page_size":20}'
# ...
# Step 3: 查询Top1应用的下载估算
curl -s -X POST "https://api.admapix.com/api/data/download-country" \
  -H "X-API-Key: ${ADMAPIX_API_KEY}" -H "Content-Type: application/json" \
  -d '{"unifiedProductId":"app_001","countries":["JP"],"dateRange":"30d"}'
# ...
Confidence
95% confidence
Finding
https://api.admapix.com/

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"keyword":"开发者名称","page":1,"page_size":10}'
# ...
# Step 2: 查询开发者详情（含旗下应用列表）
curl -s "https://api.admapix.com/api/data/developer-detail?developerId=dev_001" \
  -H "X-API-Key: ${ADMAPIX_API_KEY}"
# ...
# Step 3: 查询每个应用的SDK（并行）
Confidence
95% confidence
Finding
https://api.admapix.com/

External Transmission

Medium
Category
Data Exfiltration
Content
-H "X-API-Key: ${ADMAPIX_API_KEY}"
# ...
# Step 3: 查询每个应用的SDK（并行）
curl -s "https://api.admapix.com/api/data/sdk-detail?unifiedProductId=app_001" \
  -H "X-API-Key: ${ADMAPIX_API_KEY}"
curl -s "https://api.admapix.com/api/data/sdk-detail?unifiedProductId=app_002" \
  -H "X-API-Key: ${ADMAPIX_API_KEY}"
Confidence
94% confidence
Finding
https://api.admapix.com/

External Transmission

Medium
Category
Data Exfiltration
Content
# Step 3: 查询每个应用的SDK（并行）
curl -s "https://api.admapix.com/api/data/sdk-detail?unifiedProductId=app_001" \
  -H "X-API-Key: ${ADMAPIX_API_KEY}"
curl -s "https://api.admapix.com/api/data/sdk-detail?unifiedProductId=app_002" \
  -H "X-API-Key: ${ADMAPIX_API_KEY}"
# ...
# Step 4: 查询相似应用
Confidence
94% confidence
Finding
https://api.admapix.com/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.