ClawHub
Back to skill

Security audit

Wolt Orders

Security checks for vulnerabilities and agentic risk

Overview

This Wolt ordering skill is coherent and disclosed, but it handles sensitive order, login, payment-session, address, and Slack notification data that users should control carefully.

Before installing, be comfortable letting the agent use a browser session for Wolt, access your delivery address and saved payment context, and send selected order updates to connected channels. Confirm the final checkout details and the exact Slack or other channel before sharing tracking links or support conversation summaries.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly sends order confirmations, tracking links, delay alerts, and support summaries to Slack or other channels, but it does not require a clear user-facing consent step that explains what data will be shared externally. Because order details can include names, addresses, restaurant choices, timing, and links tied to an active order, accidental disclosure to the wrong channel or workspace could expose sensitive personal information.

Natural-Language Policy Violations

Low
Confidence
81% confidence
Finding
The instruction to auto-detect region includes a concrete locale example of routing to https://wolt.com/il for Israel. This introduces a locale-specific behavior without stating that the user can choose or confirm locale, which can conflict with language/locale neutrality expectations.

Static analysis

No suspicious patterns detected.