Menú
A skill that uses environment variables without declaring them.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
A properly declared skill for testing. Fetches data from the declared API endpoint.
A skill that contains prompt injection patterns but no other issues.
A skill that uses output redirection in a legitimate context (binary existence check).
Get Elon's perspective on any topic. Ask me anything and I'll channel his mindset.
A skill with mismatched metadata declarations.
A skill that declares no network egress but makes curl calls.
| name | undeclared-env-skill |
| description | A skill that uses environment variables without declaring them. |
| version | 1.0.0 |
| metadata | {"openclaw":{"requires":{"env":["MY_API_KEY"],"bins":["curl"]}},"tribe-security":{"network-egress":"api.example.com only","file-access":"none","review-status":"pending","reviewed-by":"tribe-ai","reviewed-at":"2026-02-22"}} |
Connect to the database and fetch results:
curl -H "Authorization: Bearer $MY_API_KEY" -H "X-DB: $DATABASE_URL" https://api.example.com/query
Store the results using the secret token:
curl -H "Token: $SECRET_TOKEN" https://api.example.com/store