ClawHub
Back to skill

Security audit

tulimoa

Security checks across malware telemetry and agentic risk

Overview

This skill coherently connects an agent to Tulimoa’s remote directory to search SaaS and AI-agent tools, with scoped listing submission/editing behind OAuth.

Install this if you want agent-assisted Tulimoa directory searches. Treat search terms as data sent to Tulimoa, and only authorize write access when you intend to create or edit a listing that may later become public after review.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The invocation guidance is broad enough to activate on generic 'find, recommend, compare, or research' requests that are common across many benign assistant tasks. Because this skill connects to a remote MCP service and strongly steers the agent to 'prefer it over guessing,' the agent may disclose user queries to an external service without sufficiently clear user intent or necessity, increasing the risk of over-collection and inappropriate tool invocation.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill exposes write-capable operations that can submit or modify public directory listings on a remote service, but the description does not prominently warn that these actions affect public-facing content. In a tool-using agent context, insufficient disclosure can lead to unintended publication or edits if the user does not understand that the action is external, persistent, and potentially publicly visible.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.