ClawHub
Back to skill

Security audit

AIKEK API

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward AIKEK API guide, but it requires careful handling of a local wallet key and non-expiring API token.

Install only if you are comfortable creating an AIKEK authentication wallet and storing a non-expiring API token locally. Do not put funds in the generated wallet, do not print or share the full token, keep ~/.config/aikek/credentials private, and explicitly approve any credit-spending API calls or referral submissions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The token-check example echoes the full API token to stdout, which can expose credentials via terminal history, logs, screenshots, shell wrappers, or shared sessions. Because the token is long-lived, accidental disclosure could allow unauthorized API use until manually revoked.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.