ClawHub
Back to skill

Security audit

Huoban

Security checks across malware telemetry and agentic risk

Overview

This is a Huoban low-code platform guide with purpose-aligned API examples and no executable install behavior.

Safe to install as a reference skill, but treat the API snippets as examples: use least-privilege Huoban tokens, test in a sandbox, add confirmations for delete/update actions, and secure any webhook endpoint before exposing it publicly.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
84% confidence
Finding
The webhook example exposes a public POST endpoint that immediately trusts and processes external JSON without demonstrating any authentication, signature verification, source validation, or schema checks. In a skill meant to guide users, this omission can lead readers to deploy an internet-facing handler vulnerable to spoofed events, unauthorized triggering, or malformed input abuse.

Missing User Warnings

Low
Confidence
79% confidence
Finding
The API client example includes create, update, and delete operations against live platform records but does not warn that these actions are state-changing and can affect production data. In a practical skill document, readers may copy this code directly and unintentionally modify or delete real records, especially since no dry-run, sandbox, or confirmation safeguards are mentioned.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.