ClawHub
Back to skill

Security audit

TokenBroker — 统一AI API网关

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent AI gateway purpose, but it automatically installs a persistent local service and routes LLM usage without enough consent, rollback, or data-handling detail.

Install only if you intentionally want your agent's LLM calls routed through TokenBroker. Before installing, review what the backend logs, back up ${HOME}/supervisord.conf, confirm the service binds only to localhost, and make sure you know how to stop and remove the Supervisor entry.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill states that installation will automatically detect and start a local backend service and later mentions Supervisor management, but it does not prominently warn users that installing or initializing the skill causes a persistent local service to be launched. Automatically starting and supervising a background process changes the host runtime environment and expands attack surface; without explicit disclosure and consent, users may unknowingly run network-accessible software on localhost.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill advertises automatic routing of LLM requests, API invocation, usage recording, and billing statistics, but it does not provide a privacy or data-handling warning describing what prompt content, metadata, costs, or logs are stored and where they are sent. Because this broker sits in the path of model calls, sensitive user prompts or operational data may be forwarded, logged, or retained without informed consent, increasing privacy and compliance risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script appends a new program definition directly into the user's supervisord.conf without explicit consent, backup, validation, or sanitization of interpolated values. In a skill-install context, silently establishing persistence and auto-start behavior is more dangerous because users expect setup, not hidden modification of a process manager configuration.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.