ClawHub
Back to skill

Security audit

Aholo 3DGS reconstruction and generation

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its stated 3D upload and task-creation purpose, but authenticated task requests are routed to an under-disclosed beta API endpoint.

Review before installing. Only use this if you are comfortable uploading selected media and using your Aholo API key for potentially paid 3D tasks, and confirm whether api-beta.aholo3d.com is the intended endpoint. Do not set AHOLO_INSECURE_SKIP_VERIFY unless you fully understand the network risk; prefer a trusted CA bundle instead.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The docstring states the global gateway is `api.aholo3d.com`, but reconstruction/generation/status requests are actually sent to `https://api-beta.aholo3d.com`. This kind of endpoint mismatch is dangerous because operators may believe production endpoints are used while sensitive API-key-authenticated requests and uploaded asset metadata are routed to a beta environment with potentially weaker controls, different data handling, or unintended exposure.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
### TLS (script default behavior)

- Script **enables** SSL verification by default (secure by default).
- Corporate/self-signed certs: set `AHOLO_INSECURE_SKIP_VERIFY=1` (or `true` / `yes` / `on`) to explicitly disable verification; prefer `REQUESTS_CA_BUNDLE` to point at your enterprise CA.
- On `CERTIFICATE_VERIFY_FAILED`, configure CA certs first; use `AHOLO_INSECURE_SKIP_VERIFY` only when you accept the risk.

### Responses & errors
Confidence
85% confidence
Finding
disable verification

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
urllib3>=2.0.0
Confidence
95% confidence
Finding
requests>=2.28.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
urllib3>=2.0.0
Confidence
95% confidence
Finding
urllib3>=2.0.0

Unsafe Defaults

Medium
Category
Tool Misuse
Content
insecure_skip = str(os.environ.get("AHOLO_INSECURE_SKIP_VERIFY", "")).strip().lower()
        if insecure_skip in {"1", "true", "yes", "on"}:
            # Explicit opt-out only (e.g. corporate self-signed certs).
            self.verify_ssl = False
            urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
        else:
            self.verify_ssl = True
Confidence
89% confidence
Finding
verify_ssl = False

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.