ClawHub

Zoho Desk

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Zoho Desk integration that uses managed OAuth to read and update support data, with no artifact-backed signs of deception or unrelated behavior.

Install only if you intend to connect Zoho Desk through ClawLink. Review the Zoho account permissions you grant, and confirm any ticket creation, department logo upload, or bulk task update before allowing the agent to run it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The skill states that write operations require confirmation, but the same document exposes multiple write-capable tools such as ticket creation, department logo upload, and bulk task updates without showing any enforced confirmation mechanism or scope guard. This can mislead users or downstream orchestrators into assuming safety properties that are not actually guaranteed, increasing the risk of unintended state-changing actions.

Vague Triggers

Medium
Confidence
77% confidence
Finding
The description and usage guidance are broad enough that an agent may invoke this skill for generic support-related requests, even when the user did not clearly intend access to Zoho Desk data or actions. In a managed OAuth integration handling tickets, contacts, departments, and agents, over-broad routing can expose sensitive support information or trigger writes in the wrong system.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal