ClawHub
Back to skill

Security audit

Zoho Recruit

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed Zoho Recruit integration that can read and change recruiting records through Maton, with no hidden executable component found.

Install only if you trust Maton with the Zoho Recruit account you connect. Use the least-privileged Zoho/Maton connection available, specify the Maton connection when you have multiple accounts, keep MATON_API_KEY secret, and approve write or delete actions only after reviewing the exact module, record IDs, and intended effect.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The file states that access is scoped to candidates, job openings, interviews, and recruitment workflows, but later documents generic CRUD and search operations for arbitrary module API names. This mismatch can mislead users and higher-level agents about the true reachable data surface, increasing the risk of unauthorized access to additional Zoho Recruit objects such as contacts, vendors, tasks, or other modules.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The security section narrows the perceived permission scope, while the same document later exposes unrestricted generic endpoints using {module_api_name} for CRUD and search. That inconsistency is dangerous because downstream agents may make trust decisions based on the narrower statement and perform actions on data categories the user did not expect to expose.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
PUT /zoho-recruit/recruit/v2/{module_api_name}/{record_id}

# Delete records
DELETE /zoho-recruit/recruit/v2/{module_api_name}?ids={id1},{id2}

# Search records
GET /zoho-recruit/recruit/v2/{module_api_name}/search?criteria={criteria}
Confidence
88% confidence
Finding
DELETE /zoho-recruit/recruit/v2/{module_api_name}?ids={id1},{id2}

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.