ClawHub
Back to skill

Security audit

FlowMind

Security checks for vulnerabilities and agentic risk

Overview

FlowMind is a coherent productivity API skill, but users should be careful because it can delete goals, tasks, notes, contacts, and tags.

Install only if you trust FlowMind with the API key and account data involved. Before using delete actions, confirm the exact record title or identity and prefer archiving/status changes where available, especially for notes, contacts, business, or financial planning data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

DELETE /goals/:id is a destructive operation exposed without any documented guardrails around confirmation, authorization context, or target verification. In an LLM-driven toolchain, if the model misresolves an ID or is induced to act on an indirect instruction, a user's goal data can be permanently removed.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

POST /goals — create (required: title) GET /goals/:id — get PATCH /goals/:id — update DELETE /goals/:id — delete GET /goals/:id/tasks — list tasks for goal

text
Fields: title, description, status (active/completed/archived), category (business/career/health/personal/learning/financial), target_date, progress (0-100), pinned

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

DELETE /tasks/:id enables irreversible removal of task records and is presented as a normal operation without safety interlocks. Because tasks may include scheduling, progress, and linked workflow context, accidental or manipulated invocation could disrupt a user's active plans and related productivity data.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

POST /tasks — create (required: title) GET /tasks/:id — get PATCH /tasks/:id — update DELETE /tasks/:id — delete GET /tasks/:id/subtasks — list subtasks POST /tasks/:id/subtasks — create subtask

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

DELETE /notes/:id is dangerous because notes often contain user-authored content that may be valuable or sensitive, and the skill gives no warning or confirmation requirements. In an agent context, an unintended delete could permanently erase important information based on an ambiguous command.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

POST /notes — create (required: title) GET /notes/:id PATCH /notes/:id DELETE /notes/:id

text
Fields: title, content, category, task_id, is_protected, pinned

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

DELETE /people/:id removes contact/person records and could erase relationship history or meeting context if invoked incorrectly. The danger is amplified in an assistant workflow because person records may be selected from search results or inferred references, making mis-targeting plausible without confirmation controls.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
POST   /people             — create (required: name)
GET    /people/:id
PATCH  /people/:id
DELETE /people/:id
GET    /people/:id/tags    — list tags
POST   /people/:id/tags    — add tag (body: {tag_id})
DELETE /people/:id/tags/:tagId

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

DELETE /people/:id/tags/:tagId is narrower than full-record deletion, but it still mutates user data and can silently remove categorization that affects organization and retrieval. Without verification of both the person and tag target, an agent could detach the wrong association from a contact.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

DELETE /people/:id GET /people/:id/tags — list tags POST /people/:id/tags — add tag (body: {tag_id}) DELETE /people/:id/tags/:tagId

text
Fields: name, email, phone, company, role, relationship_type (business/colleague/friend/family/mentor/client/partner/other), notes, birth_month, birth_day, location, last_met_date

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

DELETE /tags/:id can remove organizational metadata that may be used across notes, people, or other entities, yet no warning is given about downstream impact. In practice, an unintended tag deletion can cause broad loss of structure and hamper later retrieval or filtering.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

POST /tags — create (required: name; optional: color) GET /tags/:id PATCH /tags/:id DELETE /tags/:id

text

## Pagination & Sorting

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly documents multiple destructive DELETE endpoints but provides no guidance to require user confirmation, verify target identity, or warn about irreversible data loss. In an agent setting, this increases the chance that ambiguous or prompt-manipulated requests could trigger unintended deletion of goals, tasks, notes, people, or tags.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The API reference exposes multiple destructive DELETE operations for goals, tasks, notes, people, and tags without any caution about irreversibility, confirmation requirements, or recovery behavior. In a productivity skill where an agent may act on natural-language requests, this increases the risk of accidental or ambiguous deletion leading to permanent user data loss.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.