ClawHub
Back to skill

Security audit

Gumroad

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Gumroad integration that uses a Maton API key to read and manage storefront data, with sensitive capabilities disclosed and write actions requiring user approval.

Install only if you trust Maton as the OAuth proxy for your Gumroad account. Keep MATON_API_KEY private, select the intended Gumroad connection when multiple accounts exist, and carefully confirm every product, license, offer-code, variant, custom-field, connection, or webhook change before allowing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
85% confidence
Finding
The manifest/description says the skill is for products, sales, subscribers, licenses, and webhooks, but the body also documents additional write-capable surfaces such as offer codes, variant categories, variants, and custom fields. This scope expansion increases the chance that an agent or user will perform actions beyond the expected permission model, causing unauthorized or surprising modifications to a storefront.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The examples include customer and subscriber personal data such as email addresses and account identifiers, but the skill description does not clearly warn that it processes sensitive business/customer data. In an agent setting, this can normalize exposing or over-sharing PII in logs, prompts, or responses without adequate privacy constraints.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.