ClawHub
Back to skill

Security audit

Api Gateway

Security checks across malware telemetry and agentic risk

Overview

This skill openly connects user-approved third-party API tasks through Maton's hosted gateway and includes approval rules for risky write actions.

Before installing, confirm you are comfortable sending connected service requests and results through Maton's hosted gateway. Use least-privilege OAuth scopes, keep MATON_API_KEY out of logs and repositories, review every write or trigger action carefully, and remove connections or triggers when no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Content
---
# API 网关集成路由

托管式 API 网关路由服务。通过统一的 API 路由地址 `https://api.maton.ai/` 连接第三方服务,提供连接管理、触发器管理与安全审批流程.
**范围外**（本技能不做）: 自建 API 代理服务器、OAuth 服务端部署、API Key 生成与分发.
## 输入格式
Confidence
90% confidence
Finding
https://api.maton.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
配置后需重启会话或开启新终端生效。API Key应妥善保管,避免泄露到版本控制系统.
## 核心能力

- **统一路由**: 通过 `https://api.maton.ai/<app>/...` 路由访问 Slack、Gmail、Stripe 等服务
- **连接管理**: 创建、列出、获取、删除连接,支持 `--connection` 指定账户
- **触发器管理**: 创建事件触发器、监听事件、重放事件、配置目标
- **安全审批**: 只读 GET 优先,非 GET 操作需用户明确批准,高危操作额外审查
Confidence
92% confidence
Finding
https://api.maton.ai/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.