ClawHub

MSX

Security checks across static analysis, malware telemetry, and agentic risk

Overview

MSX is a market-intelligence integration that clearly uses an external paid service, but its sensitive network, API-key, and checkout behavior is mostly disclosed and aligned with its purpose.

Install only if you are comfortable sending market research queries and product or go-to-market details to MSX, signing in through its device flow, storing an MSX API key locally, and reviewing any Stripe checkout before subscribing. Be aware that the skill tells agents to trust a hosted instruction file that can change, so re-check the live instructions before sensitive use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

External Transmission

Medium
Category
Data Exfiltration
Content
1. Start device auth before billing or investigations:

```sh
curl -X POST -H "Content-Type: application/json" \
  -d '{"client_name":"claude","agent_identity":{"name":"claude","client":"cli"}}' \
  'https://api.msx.dev/v1/auth/device'
```
Confidence
88% confidence
Finding
curl -X POST -H "Content-Type: application/json" \ -d '{"client_name":"claude","agent_identity":{"name":"claude","client":"cli"}}' \ 'https://api.msx.dev/v1/auth/device' ``` 2. Tell the user to o

External Transmission

Medium
Category
Data Exfiltration
Content
```sh
curl -X POST -H "Content-Type: application/json" \
  -d '{"client_name":"claude","agent_identity":{"name":"claude","client":"cli"}}' \
  'https://api.msx.dev/v1/auth/device'
```

2. Tell the user to open only `verification_uri_complete`. Keep `device_code` private and poll `token_url` with it no faster than `interval` or `retry_after`:
Confidence
86% confidence
Finding
https://api.msx.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
```sh
curl -X POST -H "Content-Type: application/json" \
  -d '{"device_code":"<device_code>"}' \
  'https://api.msx.dev/v1/auth/device/token'
```

3. When polling returns `status: authorized`, store `api_key` immediately. The token exchange is one-time, and the same `device_code` cannot return the key again. Then use `api_key` as `Authorization: Bearer <api_key>` and check the account:
Confidence
90% confidence
Finding
https://api.msx.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
3. When polling returns `status: authorized`, store `api_key` immediately. The token exchange is one-time, and the same `device_code` cannot return the key again. Then use `api_key` as `Authorization: Bearer <api_key>` and check the account:

```sh
curl -H "Authorization: Bearer $MSX_API_KEY" 'https://api.msx.dev/v1/me'
```

4. Follow `/v1/me` `agent_next_step`. If it says `free_scout_available`, start exactly one investigation for the user's request before asking for Checkout. If it says `subscription_required`, tell the user their free scout is used and a paid tier is required before more MSX discovery. Recommended tier: Builder. 3 days free, then monthly Scout, Builder, or Growth credits. Builder is recommended at $79/month with 100 scout credits.
Confidence
88% confidence
Finding
https://api.msx.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
```sh
curl -X POST -H "Authorization: Bearer $MSX_API_KEY" -H "Content-Type: application/json" \
  -d '{"tier":"builder","success_url":"https://msx.dev/billing/success","cancel_url":"https://msx.dev/billing/cancel"}' \
  'https://api.msx.dev/v1/billing/checkout'
```

Show `short_url` if present; otherwise show `url`. After Stripe succeeds, call `/v1/me` again and then retry the requested investigation.
Confidence
84% confidence
Finding
https://api.msx.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
```sh
curl -X POST -H "Authorization: Bearer $MSX_API_KEY" -H "X-MSX-Agent: claude" -H "Content-Type: application/json" \
  -d '{"query":"scout new market opportunities for me to build","depth":"quick","window":"30d","max_runtime_seconds":240,"output":{"max_problem_candidates":2,"include_citations":true},"agent_identity":{"name":"claude","client":"cli"}}' \
  'https://api.msx.dev/v1/investigations'
```

7. Poll the returned `id` until `succeeded`, `failed`, `cancelled`, or `expired`, then fetch `/result`:
Confidence
89% confidence
Finding
https://api.msx.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
7. Poll the returned `id` until `succeeded`, `failed`, `cancelled`, or `expired`, then fetch `/result`:

```sh
curl -H "Authorization: Bearer $MSX_API_KEY" 'https://api.msx.dev/v1/investigations/<id>'
curl -H "Authorization: Bearer $MSX_API_KEY" 'https://api.msx.dev/v1/investigations/<id>/result'
```
Confidence
83% confidence
Finding
https://api.msx.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
```sh
curl -H "Authorization: Bearer $MSX_API_KEY" 'https://api.msx.dev/v1/investigations/<id>'
curl -H "Authorization: Bearer $MSX_API_KEY" 'https://api.msx.dev/v1/investigations/<id>/result'
```

## Conversation Opportunities
Confidence
87% confidence
Finding
https://api.msx.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
```sh
curl -X POST -H "Authorization: Bearer $MSX_API_KEY" -H "Content-Type: application/json" \
  -d '{"product":{"name":"MSX","url":"https://msx.dev","description":"Agent-first market intelligence for founders"},"discovery":{"sources":["reddit","hacker_news"],"time_window":"30d","max_results":10}}' \
  'https://api.msx.dev/v1/conversation-opportunities'
```

## Agent Identity
Confidence
88% confidence
Finding
https://api.msx.dev/

Static analysis

No static analysis findings were reported for this release.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal