ClawHub
Back to skill

Security audit

OATDA Text Completion

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward OATDA text-generation helper that sends prompts to OATDA using a declared API key, with no hidden installer or persistence.

Install this only if you trust OATDA and are comfortable sending prompts, model choices, and usage metadata to that service. Do not include secrets, regulated data, or private content unless you intend that external transmission; use a limited or monitored API key where possible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger description is broad enough to match common writing and text-generation requests, which can cause the skill to activate for many ordinary prompts and route user content to an external provider unexpectedly. In this skill, that increases the chance of unintended third-party data transmission because activation and transmission are tightly coupled.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs sending the user's prompt to a third-party API but does not require a clear user-facing privacy disclosure or consent step. Because prompts may contain sensitive or regulated information, silent transmission to OATDA creates a meaningful privacy and data-handling risk.

Static analysis

No suspicious patterns detected.