ClawHub
Back to skill

Security audit

asset-dashboard-search

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed patent-search integration that uses a Zhihuiya API token and does not show hidden persistence, local data access, or destructive behavior.

Use this only with a Zhihuiya/OpenAPI token you intend to use for patent queries. Prefer the ZHIHUIYA_API_TOKEN environment variable or a protected secret mechanism over passing --token on the command line, and review the collapse_order_authority inconsistency if result accuracy matters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs users to supply an API token via environment variable or command-line parameter without any warning that the credential is sensitive, should not be logged, and should not be exposed in process arguments. CLI parameters are especially risky because they may be visible in shell history, process listings, CI logs, or debugging output, increasing the chance of credential disclosure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.