ClawHub
Back to skill

Security audit

Api Toolkit

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly an API testing toolkit, but it asks for command execution and includes overbroad activation plus automatic network diagnostics that should be reviewed before use.

Install only if you intend to let the agent run API-toolkit-style commands for API testing. Keep use scoped to specific specs, test files, mock ports, and approved targets; do not allow automatic network diagnostics, load tests, webhook posting, scheduling, or credential setup unless you explicitly requested them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The skill’s error-handling section instructs the agent to execute `ping` and check firewall/proxy settings when content generation quality is poor or on generic internal exceptions. This introduces unrelated shell/network actions into a documentation-driven API testing skill, creating a path for unnecessary command execution and possible network egress triggered by benign failures rather than explicit user intent.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The activation guidance says to use the skill whenever code generation, programming assistance, debugging/testing, or deployment is needed, which is far broader than the documented API-toolkit purpose. Such broad triggers can cause the agent to invoke this exec-capable skill in many routine development contexts, increasing the chance of unnecessary command execution or misuse outside its intended scope.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.