ClawHub
Back to skill

Security audit

top-coding-models

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches public model ranking and pricing data from two disclosed APIs and does not show credential access, persistence, or unrelated local data use.

Install only if you are comfortable with the skill making live network requests to BenchLM and OpenRouter when run. In restricted environments, allow egress only to those two domains or avoid running the script.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
87% confidence
Finding
The markdown advertises live fetching from third-party APIs but does not prominently warn that using the skill will make external network connections. While the destinations appear relevant to the skill's purpose, the missing disclosure reduces informed consent and can surprise users in restricted or privacy-sensitive environments.

Static analysis

No suspicious patterns detected.