ClawHub
Back to skill

Security audit

Oban Designer

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Oban helper whose examples include realistic network, file, and database worker patterns that should be hardened before production use.

Treat the snippets as starting points, not production-ready security controls. Validate webhook destinations, avoid raw user-controlled URLs or filesystem paths in job args, keep secrets out of untrusted job data, narrowly scope database writes and deletes, and test cron schedules before enabling them in production.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest describes a skill for designing and implementing Oban workers with queueing, retries, uniqueness, cron scheduling, and error handling. This file also presents concrete business-operation workers for database pruning and CSV import/ETL, which go beyond Oban-focused infrastructure guidance into broader data management and application mutation behavior.

Context-Inappropriate Capability

Low
Confidence
82% confidence
Finding
The skill's stated purpose is to generate and configure Oban background jobs for Elixir projects. While background execution is relevant, this example introduces broader cross-channel product capabilities—push and SMS delivery integrations—that are not necessary to justify an Oban worker design skill and extend into domain-specific outbound messaging behavior.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.