ClawHub
Back to skill

Security audit

nilyo

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent and not malicious, but it gives agents broad access to sensitive messaging, email, calendar, and webhook data, including a risky path for entering IMAP passwords in chat.

Review this carefully before installing. Use OAuth or secure connection links where possible, avoid pasting mailbox passwords into chat, and only create webhook destinations for receiver URLs you control and intend to receive account events. Revisit connected accounts and webhook settings if you add new accounts, because the skill normally auto-includes matching future accounts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill explicitly instructs that a generic IMAP mailbox can be connected by providing login and password directly in the conversation, without a strong warning that chat-supplied credentials are extremely sensitive and may be retained in logs, transcripts, or downstream systems. Because this skill handles email access, exposing mailbox credentials can lead to full account compromise, unauthorized reading of email, password reset abuse, and lateral compromise of other linked services.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises access to LinkedIn, WhatsApp, Instagram, Telegram, email, calendars, and realtime event delivery, but it does not prominently warn that this grants an agent broad access to highly sensitive personal and business data or that data may be transmitted to third-party services. In this context, the omission is dangerous because users may authorize the skill without informed consent about account access scope, message/content exposure, and webhook forwarding of event data.

Static analysis

No suspicious patterns detected.