ClawHub
Back to skill

Security audit

Coda

Security checks for vulnerabilities and agentic risk

Overview

This is a Coda integration skill with broad but disclosed Maton automation features, and its risky actions are fenced with user-approval and least-privilege guidance.

Before installing, understand that this skill can manage Coda data and, if you explicitly approve it, create persistent Maton automations. Use read-only Coda scopes where possible, confirm every write or sharing change, and approve any trigger destination only after seeing the exact URL, data fields, and persistence behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest and top-level description narrowly frame the skill as limited to Coda docs/pages/tables/rows/formulas, but the body documents materially broader capabilities including sharing/permissions changes and generic Maton function/trigger management. That mismatch can mislead an agent or reviewer about the true action surface, increasing the chance of unexpected privileged operations such as access changes, automation deployment, or persistent forwarding being invoked under the guise of a simpler Coda skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that its trigger policy does not forward events to third-party hosts, yet later provides commands to create and update arbitrary external destinations. This inconsistency weakens operator trust boundaries and can enable persistent exfiltration of event data to external URLs if an agent follows the later instructions or treats the earlier policy statement as sufficient safety assurance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.