ClawHub
Back to skill

Security audit

dify-flow-access

Security checks across malware telemetry and agentic risk

Overview

The skill appears to perform the Dify knowledge-base integration it advertises, but it ships a live-looking internal API URL and bearer key in both documentation and code.

Review before installing. Use this only if you trust the publisher and intend to send queries to the configured Dify service. The bundled API key should be revoked or removed, and users should provide their own DIFY_BASE_URL and DIFY_API_KEY through a secure environment configuration. Avoid sending secrets or regulated data unless the Dify service and retention policy are approved.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Context-Inappropriate Capability

Medium
Confidence
99% confidence
Finding
The documentation discloses a hardcoded internal Dify base URL and a live-looking API key, which is a real secret exposure and expands the skill's effective scope into credential distribution. Anyone with access to the skill can reuse the credential to query internal systems, potentially exposing knowledge-base contents, workflows, and other sensitive data.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger conditions are broad enough to match common requests like checking documentation or querying a knowledge base, which can cause the skill to activate unexpectedly. In this context, accidental activation is more dangerous because the skill sends user queries and conversation context to an internal API, increasing the chance of unintended data transmission.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill description does not warn users that their prompts and conversation identifiers may be transmitted to an internal Dify API. This omission undermines informed consent and can lead users to disclose sensitive internal data without realizing it will leave the local interaction context.

Missing User Warnings

High
Confidence
99% confidence
Finding
Publishing a hardcoded API key without any sensitivity warning is a direct credential leak, not merely a documentation issue. Because the key appears tied to an internal service, exploitation could grant unauthorized API access, facilitate internal reconnaissance, and expose proprietary knowledge-base or workflow data.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
The script embeds a live-looking default API key directly in source code, which risks credential disclosure through source control, logs, reuse across environments, or accidental sharing. Because the script also defaults to contacting a private network service, anyone with access to the script may be able to authenticate to that backend without separate authorization.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.