ClawHub
Back to skill

Security audit

Api Generator Free

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly an API scaffolding guide, but it asks agents to run an unbundled local shell script and write generated output into project files without enough safety scoping.

Before installing, confirm what scripts/apigen.sh would be in your workspace and review it before allowing execution. Avoid redirecting output with > to existing source files unless you intend to replace them, and do not set or expose real API keys unless a trusted implementation actually requires them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill claims it covers broad adjacent scenarios beyond the explicitly defined commands, which creates ambiguous activation boundaries. In an agent setting, this can cause the skill to be invoked for requests outside its safe, intended scope and lead to unnecessary command execution or misleading code generation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation instructs users to redirect stdout into project files but does not warn that shell redirection will overwrite existing files. In practice this can destroy source files, tests, or routes if the target path already exists, causing integrity and availability impact to the project.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.