ClawHub
Back to skill

Security audit

Oauth Debugger

Security checks across malware telemetry and agentic risk

Overview

This appears to be an OAuth troubleshooting skill whose sensitive credential examples are expected for the task, but users should handle the shown secrets carefully.

Install only if you need OAuth debugging help. Treat all authorization codes, client secrets, PKCE verifiers, and access tokens as secrets: prefer test clients or short-lived credentials, avoid pasting secrets into shared shells or transcripts, and redact command output before sharing logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs users to submit highly sensitive OAuth materials such as authorization codes, client secrets, and PKCE verifiers in live curl commands without any warning about shell history, terminal logging, process inspection, or use against production tenants. In a debugging context this is risky because users are likely to test with real credentials and tokens, increasing the chance of accidental exposure.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Test token exchange
curl -s -X POST "https://$AUTH_DOMAIN/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=$AUTH_CODE" \
Confidence
90% confidence
Finding
curl -s -X POST "https://$AUTH_DOMAIN/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=authorization_code" \ -d "code=$AUTH_CODE" \ -d "redirect_uri=$REDIRE

External Transmission

Medium
Category
Data Exfiltration
Content
**Client Credentials (machine-to-machine):**
```bash
curl -s -X POST "https://$AUTH_DOMAIN/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=$CLIENT_ID" \
Confidence
91% confidence
Finding
curl -s -X POST "https://$AUTH_DOMAIN/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials" \ -d "client_id=$CLIENT_ID" \ -d "client_secret=$

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.