ClawHub

Comulytic

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent read-only Comulytic integration, but it handles login credentials and can retrieve sensitive meeting and contact data.

Install only if you trust the Comulytic service and this skill publisher with your Comulytic credentials and meeting data. Expect the agent to retrieve private summaries, transcripts, contacts, conversation snippets, and action items from Comulytic; avoid broad searches or full transcript requests unless needed, and remove or revoke ~/.comulytic/mcp-token.json when you no longer want access.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (27)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill uses environment variables, local token files, shell commands, and network access, but does not declare corresponding permissions. This weakens user awareness and any permission-gating model, especially because the skill reads credentials/tokens from disk and sends authenticated requests to an external service.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The published description presents the skill as a read-only query tool, but the setup flow performs authentication, OAuth client registration/exchange, and local token persistence. That mismatch can mislead users and platforms about the real trust boundary, causing them to approve a skill that handles credentials and stores long-lived tokens without informed consent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill queries meetings, transcripts, contacts, and conversation history by sending requests to Comulytic's remote API, but the description does not warn users that potentially sensitive business communications are transmitted to an external service. In a context involving transcripts and contact histories, lack of disclosure materially increases privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The setup instructions direct users to run a login script that stores OAuth tokens locally, but they do not disclose that access tokens are persisted on disk under the user's home directory. Silent local credential storage increases the chance of token exposure through weak file permissions, backups, shared machines, or user misunderstanding.

External Transmission

Medium
Category
Data Exfiltration
Content
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"

# Recent meetings
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"limit":10}}}' \
Confidence
91% confidence
Finding
curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
| jq '.result.content[0].text' -r | jq '.'

# By keyword
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"query":"KEYWORD","limit":5}}}' \
Confidence
91% confidence
Finding
curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
| jq '.result.content[0].text' -r | jq '.'

# By date range
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"date_from":"2025-03-01","date_to":"2025-03-31"}}}' \
Confidence
89% confidence
Finding
curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"

# Summary
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/detail","arguments":{"meeting_id":"ID"}}}' \
Confidence
92% confidence
Finding
curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
| jq '.result.content[0].text' -r | jq '.'

# Full transcript
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/detail","arguments":{"meeting_id":"ID","detail_level":"full"}}}' \
Confidence
97% confidence
Finding
curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"contacts/profile","arguments":{"contact_id":"ID","include_insights":true}}}' \
Confidence
90% confidence
Finding
curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"contacts/history","arguments":{"contact_id":"ID","limit":10}}}' \
Confidence
90% confidence
Finding
curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"conversations/search","arguments":{"query":"KEYWORD","limit":10}}}' \
Confidence
95% confidence
Finding
curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"

# All pending
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"actions/pending","arguments":{"status":"pending","limit":20}}}' \
Confidence
88% confidence
Finding
curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
| jq '.result.content[0].text' -r | jq '.'

# Overdue only
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"actions/pending","arguments":{"status":"overdue"}}}' \
Confidence
88% confidence
Finding
curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"TOOL","arguments":{ARGS}}}' \
Confidence
84% confidence
Finding
https://api.comulytic.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"

# Recent meetings
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"limit":10}}}' \
Confidence
91% confidence
Finding
https://api.comulytic.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
| jq '.result.content[0].text' -r | jq '.'

# By keyword
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"query":"KEYWORD","limit":5}}}' \
Confidence
91% confidence
Finding
https://api.comulytic.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
| jq '.result.content[0].text' -r | jq '.'

# By date range
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"date_from":"2025-03-01","date_to":"2025-03-31"}}}' \
Confidence
89% confidence
Finding
https://api.comulytic.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"

# Summary
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/detail","arguments":{"meeting_id":"ID"}}}' \
Confidence
92% confidence
Finding
https://api.comulytic.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
| jq '.result.content[0].text' -r | jq '.'

# Full transcript
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/detail","arguments":{"meeting_id":"ID","detail_level":"full"}}}' \
Confidence
97% confidence
Finding
https://api.comulytic.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"contacts/profile","arguments":{"contact_id":"ID","include_insights":true}}}' \
Confidence
90% confidence
Finding
https://api.comulytic.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"contacts/history","arguments":{"contact_id":"ID","limit":10}}}' \
Confidence
90% confidence
Finding
https://api.comulytic.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"conversations/search","arguments":{"query":"KEYWORD","limit":10}}}' \
Confidence
95% confidence
Finding
https://api.comulytic.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}"

# All pending
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"actions/pending","arguments":{"status":"pending","limit":20}}}' \
Confidence
88% confidence
Finding
https://api.comulytic.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
| jq '.result.content[0].text' -r | jq '.'

# Overdue only
curl -s -X POST https://api.comulytic.ai/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"actions/pending","arguments":{"status":"overdue"}}}' \
Confidence
88% confidence
Finding
https://api.comulytic.ai/

VirusTotal

50/50 vendors flagged this skill as clean.

View on VirusTotal