ClawHub
Back to skill

Security audit

Tianapi Ancbooks - 古籍查询

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward TianAPI ancient-books lookup helper, with the main caveat that its examples encourage less-safe API key handling.

Prefer setting TIANAPI_ANCBOOKS_KEY in your environment or a secure secret store. Avoid passing the key directly on the command line or in URLs, and if you use scripts/.env, restrict its permissions and make sure it is not committed or shared.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs users to pass the API key directly on the command line, which can expose the secret via shell history, process listings, audit logs, and terminal recordings. While this is a common convenience pattern, it unnecessarily increases the chance of credential disclosure to other local users or logging systems.

Credential Access

High
Category
Privilege Escalation
Content
# 方式一：环境变量（推荐，一次配置永久生效）
    export TIANAPI_ANCBOOKS_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_ANCBOOKS_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
Confidence
78% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
export TIANAPI_ANCBOOKS_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_ANCBOOKS_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_ancbooks.py --key 你的APIKey --id 9872ed9fc22fc182
Confidence
80% confidence
Finding
.env

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.