protocol-doc-auditorHelps detect hidden attacks in API and protocol documentation. Scans integration guides for dangerous instructions like curl|bash, credential harvesting, and...
Install via ClawdBot CLI:
clawdbot install andyxinweiminicloud/protocol-doc-auditorGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
~/.ssh/id_rsaSends data to undocumented external endpoint (potential exfiltration)
POST → https://agentconnect.io/registerPotentially destructive shell commands in tool definitions
curl | bashCalls external URL not in known-safe list
https://agentconnect.io/registerGenerated Mar 21, 2026
A financial technology company is integrating a new payment gateway API. The documentation includes instructions to run a curl command that pipes output to bash for SDK installation, potentially exposing sensitive financial data or executing malicious code. This auditor would flag such risks before deployment, preventing data breaches or unauthorized access.
A healthcare provider adopts a new protocol for sharing patient data between systems. The integration guide asks for API keys to be placed in URL parameters during setup, risking exposure in logs. The auditor detects this credential leakage, ensuring compliance with HIPAA and protecting patient privacy.
An IoT manufacturer provides documentation for configuring smart devices via a cloud service. The steps include OAuth flows that permanently bind device identities without revocation options, creating vendor lock-in. The auditor identifies this irrevocable binding, allowing users to seek alternatives or negotiate terms.
A developer contributes to an open-source project that requires running setup scripts from its documentation. The instructions use wget with sudo to install dependencies, risking privilege escalation. The auditor flags this, prompting a review to prevent system compromise during contribution.
A large enterprise migrates services to a new cloud platform, following vendor-provided integration guides. The docs include steps to send telemetry data to third-party endpoints without clear disclosure, potentially leaking internal metrics. The auditor catches this data leak setup, ensuring transparency and security.
Offer the auditor as a cloud-based service with tiered subscriptions (e.g., free for basic scans, paid for advanced features like API integration and team collaboration). Revenue comes from monthly or annual fees per user or organization, targeting businesses that regularly integrate new APIs.
Sell perpetual or annual licenses to large enterprises for on-premises deployment or high-volume usage. Include custom support, training, and integration with existing security tools. Revenue is generated through upfront license sales and ongoing maintenance contracts.
Provide a free version for individual developers to scan documentation manually, with premium add-ons like automated CI/CD integration, detailed reporting, and priority support. Revenue streams from upsells to teams and organizations needing scalable solutions.
💬 Integration Tip
Integrate this auditor into CI/CD pipelines to automatically scan documentation changes before deployment, ensuring security checks are part of the development workflow.
Scored Jun 19, 2026
AI Analysis
This skill is a security auditing tool designed to detect malicious patterns in documentation, not execute them. It analyzes text for dangerous patterns like curl|bash commands and credential exposure but doesn't send user data to external servers or override user intent. The skill's purpose is protective scanning, not malicious action.
Audited Apr 18, 2026 · audit v1.0
YouTube Data API integration with managed OAuth. Search videos, manage playlists, access channel data, and interact with comments. Use this skill when users want to interact with YouTube. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway).
Trello API integration with managed OAuth. Manage boards, lists, cards, members, and labels. Use this skill when users want to interact with Trello for project management. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway).
Fetch up-to-date library documentation via Context7 API. Use PROACTIVELY when: (1) Working with ANY external library (React, Next.js, Supabase, etc.) (2) User asks about library APIs, patterns, or best practices (3) Implementing features that rely on third-party packages (4) Debugging library-specific issues (5) Need current documentation beyond training data cutoff Always prefer this over guessing library APIs or using outdated knowledge.
API reference for CoinMarketCap DEX endpoints including token lookup, pools, transactions, trending, and security analysis. Use this skill whenever the user...
Use when designing REST or GraphQL APIs, creating OpenAPI specifications, or planning API architecture. Invoke for resource modeling, versioning strategies, pagination patterns, error handling standards.
Lightweight API mock server for prototyping and testing, supporting JSON/JSON Schema responses, dynamic data, validation, latency, and webhook simulation.