ClawHub
Back to skill

Security audit

WorkOS

Security checks for vulnerabilities and agentic risk

Overview

This WorkOS skill is mostly coherent, but it documents high-impact account and tenant administration actions without clear confirmation or scoping guidance.

Install only if you intend to let the agent help administer WorkOS. Use a least-privilege WorkOS API key where possible, avoid production keys for exploration, and require explicit human confirmation before creating organizations, generating sensitive Admin Portal links, exchanging auth codes, or deleting users.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (19)

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Auth
```bash
curl -H "Authorization: Bearer $WORKOS_API_KEY" https://api.workos.com/...
```

## Organizations
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest understates the skill's capabilities by omitting organization creation even though the documentation includes a POST to create organizations. This can mislead operators or policy systems about what actions the skill may take, reducing informed consent and allowing broader tenant-management actions than advertised.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The manifest describes SSO and directory management, but the Admin Portal intents include log_streams and audit_logs administration that are not disclosed. Hidden audit/log administration expands the effective privilege of the skill and can expose sensitive security telemetry or enable configuration changes without users realizing it.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents a destructive DELETE operation for user accounts without any warning, confirmation, or guardrails. In an agent context, this raises the risk of accidental or unauthorized account deletion, potentially causing service disruption and loss of access for enterprise users.

Description-Behavior Mismatch

Low
Confidence
82% confidence
Finding
The manifest says the skill can check SSO connection status, but the documentation includes active SSO authorization URL generation and token exchange. This is broader than passive status checking and introduces authentication-flow handling that may involve sensitive auth codes and session establishment.

Static analysis

No suspicious patterns detected.