ClawHub
Back to skill

Security audit

Vin Query - 车架号VIN查询

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward VIN lookup helper that sends a user-provided VIN and TianAPI key to TianAPI, with some credential-handling privacy caveats.

Install only if you are comfortable sending VINs to TianAPI. Prefer setting TIANAPI_VIN_KEY through your environment or a secret manager, avoid putting the key directly in commands, and do not commit or share scripts/.env if you use it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users to submit VINs to a third-party API without warning that VINs are sensitive vehicle identifiers and will leave the local system. Even if not personally identifying on their own, VINs can be linked to ownership, service, fleet, or resale data, creating privacy and compliance risks when sent externally without notice or consent.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The documentation recommends passing the API key directly on the command line, which can expose the secret through shell history, process listings, terminal logs, or audit tools. This creates a realistic credential leakage path, especially on shared systems, CI runners, or managed endpoints.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script places both the API key and VIN in the URL query string. Even though the endpoint uses HTTPS, query parameters are more likely to be exposed in logs, proxies, browser/history equivalents, monitoring systems, or upstream infrastructure, which can leak credentials and sensitive vehicle-identifying data.

Credential Access

High
Category
Privilege Escalation
Content
# 方式一：环境变量（推荐，一次配置永久生效）
    export TIANAPI_VIN_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_VIN_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
Confidence
88% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
export TIANAPI_VIN_KEY=你的APIKey

    # 方式二：.env 文件（在脚本目录创建）
    echo "TIANAPI_VIN_KEY=你的APIKey" > scripts/.env

    # 方式三：每次命令行传入
    python3 scripts/fetch_vin-query.py --key 你的APIKey --vin LSVAX60E8K2018698
Confidence
83% confidence
Finding
.env

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.