ClawHub
Back to skill

Security audit

Api Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a plain Markdown API-debugging helper that mainly generates request templates and troubleshooting guidance, with some overbroad activation wording users should understand.

Install this if you want an agent to help draft and troubleshoot API requests. Treat generated curl, OAuth, DELETE, POST, and ping commands as commands you approve before running, keep real secrets in environment variables, and avoid using it as a general programming or deployment skill despite the broad trigger wording.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill explicitly tells the agent to run live network diagnostics such as ping and to retry connectivity checks. That goes beyond passive documentation/template generation and can cause unintended outbound network activity against arbitrary hosts, which is risky in an agent context with exec enabled.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The skill description says to use it for broad categories like code generation, programming assistance, debugging, testing, and deployment. That expansive scope can cause the skill to activate for many unrelated developer tasks and steer the agent toward exec/network-capable behavior outside a narrowly defined API-template role.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The capability coverage section contains an extremely broad keyword list that can match a wide range of ordinary development prompts. In an agent ecosystem, such trigger sprawl increases the chance this skill is selected inappropriately, potentially exposing exec and network actions in contexts that did not need them.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.