ClawHub
Back to skill

Security audit

Toingg Ops Toolkit

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent Toingg automation, but it needs review because it can upload contact data and trigger calls or WhatsApp broadcasts with weak consent and retention safeguards.

Install only if you are authorized to use the Toingg account and to contact the recipients. Use a limited Toingg token, verify recipient opt-in and applicable messaging/calling rules before bulk sends, avoid committing or broadly sharing contact exports and analytics, and store generated files in access-controlled locations with short retention.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:28
Finding

Plaintext Contact Exports Recommended for Version Control or Shared Storage

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:24
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (17)

Tainted flow: 'headers' from os.getenv (line 46, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/add_contacts.py (reported line 51)May include surrounding context.

python
"Accept": "application/json",
        "Content-Type": "application/json",
    }
    response = requests.post(url, headers=headers, json=contacts, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Tainted flow: 'headers' from os.getenv (line 39, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/create_campaign.py (reported line 45)May include surrounding context.

python
"Content-Type": "application/json",
    }

    response = requests.post(API_URL, headers=headers, json=payload, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Tainted flow: 'headers' from os.getenv (line 32, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_campaigns.py (reported line 42)May include surrounding context.

python
"sort": sort,
    }

    response = requests.get(API_URL, headers=headers, params=params, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Tainted flow: 'headers' from os.getenv (line 29, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/get_campaign_analytics.py (reported line 33)May include surrounding context.

python
"Authorization": f"Bearer {token}",
        "Accept": "application/json",
    }
    response = requests.get(API_URL, headers=headers, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Tainted flow: 'headers' from os.getenv (line 31, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/make_call.py (reported line 47)May include surrounding context.

python
"extraParams": {},
    }

    response = requests.post(API_URL, headers=headers, json=payload, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Tainted flow: 'headers' from os.getenv (line 44, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/send_whatsapp_templates.py (reported line 49)May include surrounding context.

python
"Accept": "application/json",
        "Content-Type": "application/json",
    }
    response = requests.post(API_URL, headers=headers, params=params, json=payload, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill explicitly enables bulk WhatsApp outreach from uploaded Excel contact sheets, but it does not require any consent check, lawful-basis verification, recipient opt-in confirmation, or warning about privacy, spam, and data-protection obligations. In context, this makes misuse easier by operationalizing mass messaging against real contact data while normalizing storage and processing of personal information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow instructs users to upload names and phone numbers to an external messaging service and send WhatsApp templates, but it omits any guidance on consent, lawful basis, data minimization, retention, or secure handling of contact data. This creates a real privacy and compliance risk because operators may process personal data improperly or disclose it to third parties without adequate safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown template documents a payload that includes a real notification phone field, lead notifications enabled, and outbound calling enabled, but it does not warn users that using these settings may place calls or send alerts affecting external parties. For markdown files, the skill description should disclose behaviors that can affect user data, privacy, or system integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This JSON config hard-codes the language to "english" for the campaign, and similar fixed language settings appear in other campaign entries as well. Per the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The configuration explicitly fixes the campaign language to "english-us". Because the file does not show any opt-in, fallback, or documented justification for this locale constraint, it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/add_contacts.py (reported line 51)May include surrounding context.

python
"Accept": "application/json",
        "Content-Type": "application/json",
    }
    response = requests.post(url, headers=headers, json=contacts, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_campaign.py (reported line 45)May include surrounding context.

python
"Content-Type": "application/json",
    }

    response = requests.post(API_URL, headers=headers, json=payload, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/make_call.py (reported line 47)May include surrounding context.

python
"Content-Type": "application/json",
    }

    response = requests.post(API_URL, headers=headers, json=payload, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_whatsapp_templates.py (reported line 49)May include surrounding context.

python
"Accept": "application/json",
        "Content-Type": "application/json",
    }
    response = requests.post(API_URL, headers=headers, params=params, json=payload, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This code performs a network POST to an external API using campaign, contact-list, and payload data, but there is no confirmation prompt, explicit log message at send time, or warning comment/docstring explaining that user-provided data will be transmitted. For a code file, network calls that transmit user or system data should have some visible disclosure unless the warning is clearly documented elsewhere in the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The example payload sets the language to "english" and the surrounding text does not indicate that language is optional, user-selectable, or required for a documented regional reason. This can be read as forcing a specific language by default without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.