ClawHub
Back to skill

Security audit

Api Integration Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward API-integration guide; it teaches API-key REST calls and does not hide persistence, destructive behavior, or unrelated data access.

Install only if you want an agent to help write and run API-call code. Use scoped or test API keys, avoid putting secrets in prompts or source files, and review any outbound request before sending real personal, business, or internal data to a third-party endpoint.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs agents to use API keys with third-party services but does not warn that prompts, user data, system context, or secrets may be transmitted externally. In an agent setting, this omission can lead users to send sensitive data to external APIs without understanding the privacy and security implications.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests

response = requests.get(
    'https://api.example.com/v1/users',
    headers={'Authorization': 'Bearer your_api_key_here'}
)
response.raise_for_status()
Confidence
87% confidence
Finding
https://api.example.com/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.