ClawHub
Back to skill

Security audit

Toingg Ops Toolkit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly disclosed Toingg automation toolkit, but it has unsafe outreach and data-handling defaults that deserve manual review before installation.

Review and edit the campaign template before use, especially leadNotificationPhone, leadNotification, outbound/autopilot, and handoff settings. Only upload or message contacts with proper consent, avoid committing contact exports or analytics to version control, store generated files in access-controlled locations, and use pinned dependencies in a virtual environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
references/payload-template.md:46
Finding

Hardcoded Lead Notification Recipient in Campaign Template

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:26
Finding

Documentation Encourages Unsafe Retention of Sensitive Contact and Analytics Data

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:22
Finding

Unpinned Runtime Dependencies Installed from Mutable Package Index State

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)

Tainted flow: 'headers' from os.getenv (line 46, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/add_contacts.py (reported line 51)May include surrounding context.

python
"Accept": "application/json",
        "Content-Type": "application/json",
    }
    response = requests.post(url, headers=headers, json=contacts, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Tainted flow: 'headers' from os.getenv (line 39, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/create_campaign.py (reported line 45)May include surrounding context.

python
"Content-Type": "application/json",
    }

    response = requests.post(API_URL, headers=headers, json=payload, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Tainted flow: 'headers' from os.getenv (line 29, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/get_campaign_analytics.py (reported line 33)May include surrounding context.

python
"Authorization": f"Bearer {token}",
        "Accept": "application/json",
    }
    response = requests.get(API_URL, headers=headers, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Tainted flow: 'headers' from os.getenv (line 44, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/send_whatsapp_templates.py (reported line 49)May include surrounding context.

python
"Accept": "application/json",
        "Content-Type": "application/json",
    }
    response = requests.post(API_URL, headers=headers, params=params, json=payload, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill operationalizes bulk contact upload and WhatsApp broadcasting from Excel sheets, including optional resend behavior, but does not require any explicit consent, lawful-basis, privacy notice, data-minimization, or recipient-verification step before processing personal data. In this context, the omission increases the risk of spam, unauthorized outreach, and mishandling of phone numbers and contextual data, especially because the workflow is framed as a ready-to-run automation pattern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The workflow explicitly instructs users to upload contact data and send WhatsApp templates, but it provides no safeguards around lawful basis, user consent, data minimization, or handling of personal data such as names and phone numbers. In a messaging workflow, this omission can enable privacy violations, unsolicited messaging, and misuse of contact lists even if the document is operational rather than overtly malicious.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The template defaults to outbound calling, lead notifications, and a real-looking hard-coded phone number without any warning that using the template may contact actual recipients or send alerts externally. In an agent skill context, this increases the risk of unintended real-world actions, privacy issues, and accidental telecom abuse if users reuse the template as-is.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/add_contacts.py (reported line 51)May include surrounding context.

python
"Accept": "application/json",
        "Content-Type": "application/json",
    }
    response = requests.post(url, headers=headers, json=contacts, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_campaign.py (reported line 45)May include surrounding context.

python
"Content-Type": "application/json",
    }

    response = requests.post(API_URL, headers=headers, json=payload, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code sends the provided JSON payload to an external API and includes a bearer token in the request, which is a safety-relevant network operation. While the module docstring states the script creates a campaign via the public API, there is no user-facing log, confirmation, or inline warning near the transmission point to disclose that user-supplied data will be sent off-system.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_whatsapp_templates.py (reported line 49)May include surrounding context.

python
"Accept": "application/json",
        "Content-Type": "application/json",
    }
    response = requests.post(API_URL, headers=headers, params=params, json=payload, timeout=60)
    try:
        response.raise_for_status()
    except requests.HTTPError as exc:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code sends campaign, template, language, contact list, and payload data to an external API via an HTTP POST request. Although the script purpose implies sending messages, there is no visible runtime notice, confirmation, or inline warning that user-supplied data will be transmitted off-system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example payload sets the language to "english" and the document does not indicate that this is merely an example choice or that users should select their preferred language. This can be read as enforcing a specific language by default without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The CLI requires a template language code and gives an example of a locale-specific value, but there is no natural-language guidance about user opt-in, supported alternatives, or justification for locale constraints. Under the policy, forcing or assuming a language/locale without clear user choice can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.