ClawHub
Back to skill

Security audit

AutomateLab agency-os

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it can change a live Notion task board from loose chat phrases, so users should review its scope before installing.

Install only if you intentionally want the agent to manage and mutate a live Notion task system. Prefer slash commands for changes, require explicit task IDs or confirmations for approve, done, kill, move, and run --go, and keep the Notion integration limited to the intended workspace.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill treats broad natural-language phrases as mutation triggers for a high-impact system that writes directly to Notion. In conversational contexts, ambiguous statements like 'approve it' or 'log: ...' can be misinterpreted as commands, causing unintended state changes, task creation, or execution without sufficiently explicit user intent.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The natural-language mapping includes short, common phrases such as 'approve', 'go ahead', 'show me X', and 'what's the status', some of which directly trigger mutations. Because the skill is connected to live Notion write operations, an attacker or even ordinary dialogue could induce unintended command execution through prompt injection, quoted text, or conversational ambiguity.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The natural-language activation examples indicate the skill may respond to a wide range of loosely phrased user inputs without explicit boundaries, confirmation requirements, or intent validation. In an agentic workflow tied to task state changes, this increases the risk of unintended or adversarially induced actions such as approving, killing, or closing tasks based on ambiguous text.

Static analysis

No suspicious patterns detected.