Back to skill
Skillv1.0.2
ClawScan security
ApiTest · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousMar 4, 2026, 11:44 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's stated purpose (call a local GET endpoint using an API_TEST_KEY) is coherent, but there are inconsistencies and behavioral choices — notably missing registry metadata for the required env var and broad auto-triggering — that could cause unexpected local calls or misuse of a sensitive token.
- Guidance
- Before installing: (1) note that this skill will read an environment variable (API_TEST_KEY) and automatically call http://localhost:8080/gettool when trigger patterns match — if that token is sensitive, avoid exposing it globally or consider using a least-privilege token. (2) Ask the author to fix registry metadata to declare API_TEST_KEY as a required env var and to set the credential scope to read-only if possible. (3) Consider disabling auto-invoke or narrowing the trigger patterns to avoid accidental invocations in unrelated conversations. (4) Ensure the local service on localhost:8080 is trusted (an attacker-controlled local service could return sensitive data). If these issues concern you and cannot be addressed, treat the skill as potentially risky and do not install it system-wide.
Review Dimensions
- Purpose & Capability
- noteThe skill name/description match the runtime instructions: it will call http://localhost:8080/gettool and use an API_TEST_KEY from the environment. However, the registry metadata lists no required env vars while SKILL.md declares API_TEST_KEY as required/primary; this metadata mismatch is unexpected and should be corrected.
- Instruction Scope
- concernSKILL.md explicitly instructs the agent to read API_TEST_KEY and issue a GET to /gettool — that behavior is scoped. But auto_invoke is true with fairly broad trigger patterns (e.g., '调用.*接口' or '请求.*localhost'), which could cause the skill to run in contexts the user did not intend. Automatic reading of a sensitive environment variable and making network calls to localhost increases the chance of accidental exposure or unexpected interactions with local services.
- Install Mechanism
- okNo install spec and no code files — the skill is instruction-only and does not write files or download code. This is low-risk from an installation perspective.
- Credentials
- noteThe only secret the skill needs is API_TEST_KEY, which is proportionate to calling an authenticated local API. That said, the registry metadata failing to declare this required env var is an inconsistency. Also the SKILL.md lists the credential scope as 'read-write' even though the skill performs a GET (read) operation — 'read' would be a more appropriate scope to request.
- Persistence & Privilege
- okThe skill does not request always:true and does not persist configuration or modify other skills. Autonomous invocation is enabled (normal), but combined with the broad triggers (see instruction_scope) this raises the main operational concern rather than a persistence/privilege issue.