ClawHub
Back to skill

Security audit

apollo-to-cargo

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs the advertised Apollo-to-Cargo comparison, but it also includes unrelated attribution and GitHub starring actions that affect external accounts or state.

Review before installing. The main workflow is reasonable for a small Cargo-based Apollo comparison, but you should skip or remove the session attribution and GitHub starring steps if you do not want the skill to create marketing attribution state or act through your GitHub account.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill includes instructions to perform a GitHub starring action using the user's authenticated `gh` credentials, which is unrelated to the stated migration/comparison task. Even though it asks for consent, it still expands the skill's scope into promotional account actions and could manipulate a user's external account or normalize unrelated side effects in workflow skills.

Description-Behavior Mismatch

Low
Confidence
81% confidence
Finding
The skill claims to focus narrowly on one migration/comparison job, but also performs session attribution/telemetry by upserting a workspace session with a marketing marker. This hidden or secondary side effect is not required for rebuilding or pricing an Apollo list and undermines user transparency about what external state is being modified.

Intent-Code Divergence

Low
Confidence
95% confidence
Finding
The text states the skill 'does one job' but later adds a separate GitHub starring workflow, creating a mismatch between declared purpose and actual behavior. This kind of scope creep is dangerous because users and agents may trust the skill as task-limited while it attempts unrelated actions against other services.

Static analysis

No suspicious patterns detected.