Security audit
Security checks for vulnerabilities and agentic risk
This is a simple API testing skill whose network requests are disclosed and purpose-aligned, with a caution that write-capable endpoints should be used carefully.
Install only if you want Claw to make HTTP requests to APIs you specify. Use test accounts or non-production environments for POST, PUT, DELETE, or any endpoint that may create, change, or delete data, and avoid providing sensitive tokens unless they are necessary for the test.
The skill supports GET, POST, PUT, and DELETE requests, yet it does not warn that API testing can trigger state-changing or destructive operations on target systems. Users may assume the skill is only observational, but testing write-capable endpoints can create, modify, or delete data in production environments.
The skill supports GET, POST, PUT, and DELETE requests, yet it does not warn that API testing can trigger state-changing or destructive operations on target systems. Users may assume the skill is only observational, but testing write-capable endpoints can create, modify, or delete data in production environments.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Provide API endpoints and Claw will test them:
- "Check if https://api.example.com/v1/status is responding correctly"
- "Test all endpoints in this API and report which ones are failing"
- "Monitor these 5 endpoints and tell me their average response times"
- "Verify that the /users endpoint returns a JSON array with the expected fields"
No suspicious patterns detected.