Back to skill
Skillv0.1.0
ClawScan security
Stove Taker Api · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
ReviewMar 14, 2026, 9:27 AM
- Verdict
- Review
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill mostly matches its stated purpose (calling Stove Taker API) but contains authentication documentation that doesn't match the shipped script and metadata omissions — this mismatch could lead to misconfiguration or inadvertent credential exposure if the real API actually requires a secret-based signature.
- Guidance
- This skill implements CLI calls to the Stove Taker API and will send whatever API Key you provide to the configured base_url (default https://proto.stove.finance). Before installing or using it: 1) Verify whether the actual Stove API requires an API Secret and HMAC signature — the included docs say a Secret/signature is required but the script does not implement signing; if the API does require signing, this tool may not work and you should not supply a secret to an untrusted skill. 2) Treat the API Key as sensitive: provide it only via the skill's secret config (do not paste into chat) and consider using a scoped key for testing. 3) Prefer using the test environment (use_test_env or --env test) when trying the skill. 4) If you rely on this in production, review the Python script source locally to ensure it meets your security and signing requirements or extend it to implement the documented HMAC signing flow. 5) The metadata omission (registry showing no required creds) is a red flag: confirm with the provider/maintainer why the documentation and runtime arguments differ before trusting this skill with real credentials.
Review Dimensions
- Purpose & Capability
- noteName, description, docs and script all target the Stove Protocol Taker API and the provided CLI covers validate/lock/unlock/fill/query operations — those capabilities align with the stated purpose. However, the reference docs describe an API Key + Secret HMAC signature flow, while the runtime script and SKILL.md only use a single X-API-Key header (no signature/timestamp). This is an inconsistency between documentation and implementation.
- Instruction Scope
- okSKILL.md instructs the agent to run the included Python script which only performs HTTP(S) requests to the configured base_url and prints JSON. The instructions and script do not read local filesystem paths or environment variables outside the declared config, nor do they send data to unexpected endpoints.
- Install Mechanism
- okThis is an instruction-only skill with no install spec; the script is included in the bundle and will be executed directly. No external downloads or package installs are performed by the skill itself.
- Credentials
- concernSKILL.md/config requires an API Key (secret) passed as a skill config parameter — reasonable for this API. But registry metadata earlier listed no required credentials, which is inconsistent with the skill's runtime config. More importantly, the reference docs describe an API Secret and signature headers (X-API-Signature, X-API-Timestamp), yet the script does not accept or generate a signature or timestamp — if the real Stove API requires an API Secret, this script will fail or the user may be prompted to provide a secret elsewhere. The skill will transmit the provided API Key in requests to the configured base_url (defaulting to proto.stove.finance).
- Persistence & Privilege
- okalways is false, and the skill does not request elevated persistent privileges or modify other skills/config. It requires network permission (declared) to contact the API, which is appropriate for its purpose.