ClawHub
Back to skill

Security audit

Api Connect Hub

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent API integration helper, but it asks agents to manage high-impact workflows, persistent credentials, and replayable webhook events without enough explicit safeguards.

Review carefully before installing in a production agent. Use least-privilege API credentials, prefer Vault or another secret manager, avoid logging webhook payloads or tokens, require explicit confirmation for bulk syncs and replay, and test workflows in a non-production environment first.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill describes workflow orchestration and data synchronization actions that can modify external systems, retry operations, and apply compensation logic, but it does not clearly warn users that these actions may create, update, delete, or replay business data across connected services. In an agent context, weak warnings increase the chance of unintended destructive or large-scale side effects from ambiguous prompts or misconfiguration.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The Webhook section highlights receipt, persistence, retry, and replay of events but omits clear warnings that webhook payloads may contain sensitive personal, financial, or operational data and that replay can re-trigger downstream actions. In a multi-system integration platform, undocumented persistence and replay behavior materially increases privacy, retention, and unintended-action risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The OAuth2 auto-refresh section discusses storing and rotating refresh tokens but does not clearly warn that refresh tokens are highly sensitive long-lived credentials whose compromise can grant continued API access. In an agent-managed integration system, silent persistence and rotation of these secrets without explicit safety guidance raises the risk of insecure storage, mishandling, and unauthorized reuse.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.