critical
suspicious.exposed_secret_literal
- Location
- skill.md:330
- Finding
- File appears to expose a hardcoded API secret or token.
NodeMaven – Premium Proxies for Account Management, Automation, and Scraping
AdvisoryAudited by Static analysis on May 10, 2026.
Overview
Detected: suspicious.exposed_secret_literal
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
ConcernMedium Confidence
ASI03: Identity and Privilege AbuseWhat this means
If the redacted value is a real proxy password, someone with access to the skill artifact could use the proxy account or cause costs and abuse tied to that account.
Why it was flagged
The supplied static scan says the skill file appears to contain a hardcoded proxy password. Proxy credentials are explicitly treated by the skill as secrets, so including one in the artifact could allow unauthorized proxy use or billing impact.
Skill content
suspicious.exposed_secret_literal ... Evidence: proxy_password: [REDACTED]
Recommendation
Do not install until the publisher confirms the value is only a dummy placeholder. If it was real, remove it from the skill, rotate the proxy credential, and publish only placeholders or environment-variable references.
NoteHigh Confidence
ASI03: Identity and Privilege AbuseWhat this means
Providing these credentials lets the agent validate the account, configure proxy access, and potentially affect usage or sub-user settings.
Why it was flagged
The skill openly requires handling provider API keys, proxy usernames/passwords, and sub-user passwords. This is aligned with the proxy-management purpose, but it grants access to a paid external account.
Skill content
The agent handles three classes of secrets: ... NodeMaven API key ... Proxy credentials ... Sub-user passwords
Recommendation
Use a least-privilege API key if available, avoid pasting credentials into shared chats, rotate exposed keys/passwords, and confirm any account or sub-user changes before they happen.
NoteHigh Confidence
ASI02: Tool Misuse and ExploitationWhat this means
The agent could guide actions that create accounts, buy proxy plans, or change service configuration.
Why it was flagged
The skill includes account creation and purchase workflows for a paid proxy service. This is part of its stated purpose, but spending money or changing provider account state is high-impact.
Skill content
Guide the user through account creation, purchase, or API-key retrieval.
Recommendation
Require explicit user confirmation before any purchase, plan change, sub-user creation, password rotation, or other account mutation.
NoteHigh Confidence
ASI02: Tool Misuse and ExploitationWhat this means
Misuse could lead to account bans, legal issues, or unintended traffic attributed to the user’s proxy account.
Why it was flagged
The skill is designed for proxy-backed automation and mentions anti-detect account workflows. That is disclosed and purpose-aligned, but it can be used in ways that violate platform rules or laws.
Skill content
scraping, browser automation, and data collection ... stronger anti-detect setups
Recommendation
Use the skill only for authorized workflows and comply with target site terms, laws, and provider policies.
NoteHigh Confidence
ASI04: Agentic Supply Chain VulnerabilitiesWhat this means
Users have less assurance that the instructions came from the official provider or a trustworthy maintainer.
Why it was flagged
The artifact has no declared source repository or homepage. There is no executable install payload, but provenance matters because the skill asks users to rely on provider endpoints and credentials.
Skill content
Source: unknown; Homepage: none
Recommendation
Verify the NodeMaven domains and API documentation independently before entering credentials or making purchases.