ClawHub
Back to skill

Security audit

PhantomBuster

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed PhantomBuster command-line helper that can control remote automations and fetch their results, so it should be used carefully but is not deceptive.

Install this only if you want Codex to operate your PhantomBuster workspace. Keep the API key in a trusted environment, verify agent IDs and arguments before launch or abort, and treat fetched CSV/output data as potentially sensitive personal or business data subject to platform terms and privacy obligations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill clearly relies on environment access for an API key and network access to control PhantomBuster agents, yet the manifest does not declare those permissions. Undeclared capabilities reduce transparency and can mislead users or policy systems about what the skill can access, especially when the skill can trigger external automations and retrieve remote data.

Description-Behavior Mismatch

Low
Confidence
89% confidence
Finding
The file adds a `fetch-result` capability that is not described in the manifest/metadata, increasing the skill's effective permissions and data access beyond what a reviewer or user would expect. Hidden or undocumented capabilities are dangerous because they can bypass approval expectations and enable unintended exfiltration of automation outputs, which may contain scraped leads or other sensitive business data.

Context-Inappropriate Capability

Low
Confidence
92% confidence
Finding
The skill bypasses the documented PhantomBuster API and directly constructs an S3 URL using storage path fields returned by the API, then downloads result data from that storage. Direct storage access can weaken auditing and policy enforcement, and may expose result artifacts in a less controlled path than intended, especially given this skill's context of scraping and lead-generation outputs.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The usage section encourages launching, aborting, and fetching results from PhantomBuster agents without clearly warning that these actions may initiate scraping, account automation, or handling of privacy-sensitive third-party data. In this context, the missing warning is more dangerous because the skill is explicitly marketed for LinkedIn, Twitter, Instagram, and lead-generation workflows, where users may trigger external actions with legal, privacy, or account-abuse consequences.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.