ClawHub
Back to skill

Security audit

Category News - 分类新闻

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward TianAPI news lookup tool, with some credential-handling caveats but no evidence of hidden, destructive, or unrelated behavior.

Before installing, be aware that the skill uses your TianAPI key to make external HTTPS requests to TianAPI. Prefer an environment variable or a carefully protected .env file over passing the key on the command line, avoid sharing logs that contain full request URLs, and expect that the documented environment variable may need adjustment because the script currently reads TIANAPI_KEY.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation instructs users to pass the API key directly as a command-line argument, which can expose the secret via shell history, process listings, terminal logs, and CI job output. In this skill's context, the key grants access to a third-party account/API quota, so leakage can lead to unauthorized use, billing abuse, or service disruption.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
Embedding the API key in a URL query string risks disclosure through browser history, proxy logs, server logs, referrer headers, and shared terminal transcripts. Even though this is only example documentation, it normalizes an insecure pattern that can leak usable credentials to multiple intermediaries.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The API key is placed in the URL query string, which is more likely to be captured in logs, proxies, browser/history equivalents, monitoring systems, or error messages than a header or POST body value. Although the request uses HTTPS, query-string secrets still increase credential exposure risk if surrounding infrastructure records full URLs.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.