ClawHub

intercom-conversations

Security checks across malware telemetry and agentic risk

Overview

This is a coherent read-only Intercom conversation lookup skill, but it can expose customer support content to the agent using the provided Intercom token.

Install only where the agent is allowed to view Intercom support conversations. Use the narrowest read-only Intercom token available, avoid broad workspace tokens, and treat returned conversation content as customer-sensitive data that may enter the agent context.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill documentation asks users to provide an `INTERCOM_ACCESS_TOKEN` and exposes actions that retrieve conversation data, but it does not clearly disclose that the skill will access potentially sensitive customer support content from Intercom. This creates a transparency and consent problem: users may supply a high-privilege token without understanding the scope of data access, increasing the risk of unintended exposure of customer messages and related metadata.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This skill provides read access to Intercom conversations, which can contain sensitive customer communications, but the specification includes no privacy warning, consent expectations, or data-handling constraints. In an agent ecosystem, that omission increases the risk of over-broad use, accidental retrieval of sensitive content, and downstream exposure of personal or confidential information.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal