ClawHub
Back to skill

Security audit

api-toolkit

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent API testing skill, but it needs Review because it can run heavy load tests and persist real API traffic without clear authorization and redaction guardrails.

Install only if users will run it against APIs they own or are explicitly authorized to test. Before using record/replay or load testing, configure redaction for credentials and sensitive fields, keep recordings out of source control, set conservative concurrency and rate limits, and avoid production or third-party targets unless approved.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill promotes load testing of target APIs but does not clearly warn against running it against production systems or third-party services without authorization. In an exec-capable skill, this omission materially increases the risk of abusive traffic generation, service degradation, account suspension, or unintended denial of service.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The recording/replay feature captures real API traffic but does not clearly warn that requests and responses may contain secrets, tokens, personal data, or regulated information. In this skill context, recorded fixtures can easily persist sensitive material to disk and later be shared, replayed, or committed, causing credential exposure and data leakage.

Static analysis

No suspicious patterns detected.