Security audit

Jobaudit

Security checks for vulnerabilities and agentic risk

Overview

This may be a legitimate job-cost audit skill, but the package is incomplete and its installer makes persistent and network changes without clear user control.

Review before installing. Ask the publisher to include the missing jobaudit executable source, document exactly what OpenClaw job-history data is read or sent to Signalloom, and make telemetry plus shell-profile edits explicit, optional, and reversible.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill declares no permissions, but the metadata indicates shell-capable installation behavior via a required binary and install hook. That creates an execution surface users are not clearly warned about, which is risky because shell-capable skills can modify the local environment or invoke external programs without transparent consent.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a local audit/reporting tool, but the detected behavior includes persistence/setup changes, PATH modification, telemetry to an external API, and prompting for a third-party API key. This mismatch is dangerous because users may grant trust based on the benign description while the skill performs broader system changes and network communication that can affect privacy, integrity, and supply-chain risk.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The installer makes an unsolicited outbound analytics request to a third-party service that is not necessary to install a local cron/job audit skill. Even though the payload appears limited to skill metadata, hidden network activity during installation violates least surprise and creates privacy and supply-chain trust concerns.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The installer silently appends to the user's ~/.zshrc to alter PATH, creating persistent environment changes unrelated to the stated purpose of auditing job history. Startup-file modification can have lasting side effects, may break user environments, and is risky when performed without consent.

Intent-Code Divergence

Low

Confidence: 80% confidence
Finding: The script frames the outbound request as a harmless install ping while also steering the user toward setting an API key for an external service. This mismatch between the skill's stated purpose and the installation messaging is suspicious because it normalizes trust in a separate service and reduces informed consent.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The installer sends a network request without clearly informing the user or requesting consent. Silent telemetry during installation undermines transparency and can leak metadata about the user's actions to a third party.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The installer modifies ~/.zshrc without an explicit warning or confirmation, causing silent persistent changes to the user's shell environment. Unauthorized persistence-related changes are dangerous because they outlive the install session and can affect future command execution.

Static analysis

No suspicious patterns detected.