ClawHub
Back to skill

Security audit

Api Gateway Free

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a read-only hosted API gateway, but it asks for broader local capabilities and has overly broad activation language that could expose data or allow actions outside that narrow purpose.

Install only if you are comfortable giving an agent command execution access and possible file-write authority while routing third-party account queries through Maton. Use read-only service scopes, avoid sending sensitive data unless needed, and prefer a version whose trigger conditions and declared tools are narrowed to read-only API gateway tasks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The skill claims the free edition is limited to read-only GET/list operations, but its metadata exposes both exec and write tool capabilities. This mismatch can mislead users and downstream agents into granting broader privileges than the documented behavior suggests, increasing the chance of unintended command execution or file modification.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Advertising file-writing capability for a supposedly hosted read-only API gateway violates least privilege and expands the attack surface unnecessarily. An agent selecting this skill for benign read-only tasks could still gain the ability to alter local files, which is inconsistent with user expectations and increases risk.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The feature summary states the skill supports file read/parse/write operations, which directly contradicts the stated purpose of a read-only gateway skill. Contradictory capability claims are dangerous because they obscure the real privilege boundary and may cause an orchestrator or user to trust the skill in situations where broader actions are possible.

Vague Triggers

High
Confidence
95% confidence
Finding
The trigger condition is extremely broad, activating for generic development-related requests rather than narrowly scoped API gateway tasks. Overbroad activation can cause the skill to be selected in unrelated contexts, exposing external network access, exec, or write capabilities where they were neither expected nor necessary.

External Transmission

Medium
Category
Data Exfiltration
Content
# API 网关集成路由（免费版）

托管式 API 网关路由服务免费版。通过统一的 API 路由地址 `https://api.maton.ai/` 连接第三方服务,支持只读 GET 操作与基础连接管理.
> **升级提示**: 触发器管理、事件重放、写操作审批流程、高危操作审查、多语言调用等高级功能为付费版专享。升级付费版解锁完整能力.
## 输入参数
| 参数名 | 类型 | 必填 | 说明 |
Confidence
90% confidence
Finding
The skill explicitly routes requests to an external hosted endpoint, which means user data and query contents may be transmitted off-platform. In this context, external transmission is expected for an API gateway skill, but it remains security-relevant because the document also presents broad triggering and inconsistent privilege claims, increasing the chance of unintended data exposure.

Static analysis

No suspicious patterns detected.