ClawHub
Back to skill

Security audit

Google Contacts

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Google Contacts connector that can read and change contacts through Maton with user approval, and no hidden code or installer behavior was found.

Install only if you trust Maton as the OAuth proxy for your Google Contacts. Confirm the active Google connection before use, review every proposed write or delete, be especially careful with group deletion using deleteContacts=true, and avoid printing MATON_API_KEY in shared logs or terminals.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill documents a contact-group deletion operation that can optionally cascade into deleting all contacts in the group via `deleteContacts=true`, but the warning is brief and not prominent relative to the destructive impact. In an agent setting, insufficient guardrails around such an option increases the chance of accidental mass deletion of user data.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.