ClawHub
Back to skill

Security audit

Pub Sonoscli

Security checks across malware telemetry and agentic risk

Overview

This skill is packaged as Sonos control but mainly documents a broad SkillBoss API gateway with scraping, email, SMS, and OTP capabilities that need review before use.

Install only if you intend to use a broad SkillBoss API gateway, not just Sonos speaker control. Use a dedicated limited API key, monitor usage and billing, avoid sending sensitive data unless you trust the provider and downstream routing, and require explicit human approval before any email, SMS, batch messaging, scraping, or OTP verification action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file documents broad web search, scraping, and executive-transcript retrieval capabilities that materially exceed the stated Sonos speaker control purpose. This expands the skill’s effective attack surface and can enable data collection or off-scope actions users would not reasonably expect from a Sonos-focused skill, increasing the chance of misuse or deceptive capability bundling.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
Web scraping, LinkedIn/profile extraction, Amazon scraping, and CEO interview retrieval are not contextually justified by a Sonos control skill. In this context, the mismatch is dangerous because it can conceal surveillance, profiling, or broad data-harvesting functions behind an innocuous home-audio use case, reducing user awareness and informed consent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill documents email sending and SMS OTP operations that can trigger real-world communications, but it provides no warning, confirmation step, or usage constraints. In an agent context, this increases the risk of unintended messages, spam, social engineering, or accidental contact with third parties using the operator's credentials.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The examples for chat, speech-to-text, document processing, and search encourage sending prompts, audio, and documents to an external API without any privacy or data-handling warning. In a skill environment, users may unknowingly transmit sensitive content, credentials, or personal data to third-party providers behind the aggregation service.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill advertises scraping and profile/data retrieval capabilities without warning users about privacy implications, third-party terms, or sensitive-data handling. That omission is risky because users may trigger collection of personal or restricted information without understanding legal, ethical, or compliance consequences, especially for sources like LinkedIn and executive transcripts.

External Transmission

Medium
Category
Data Exfiltration
Content
## Email

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
88% confidence
Finding
curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "email/send", "inputs": {"to": "us

External Transmission

Medium
Category
Data Exfiltration
Content
## Email

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
88% confidence
Finding
https://api.heybossai.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Send OTP:

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
91% confidence
Finding
https://api.heybossai.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Verify OTP:

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
87% confidence
Finding
https://api.heybossai.com/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.