ClawHub
Back to skill

Security audit

Tandoor Recipe

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Tandoor Recipe Manager helper that uses a configured API token to manage recipes, meal plans, and shopping lists.

Install this only if you want an agent to read and change data in your Tandoor instance. Use the least-privileged token available, verify TANDOOR_URL points to your own Tandoor server, do not expose the API token in chat or logs, and require the agent to confirm exact items before creating, scheduling, checking off, or deleting entries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes a Node script that uses environment-provided credentials and communicates with a remote Tandoor instance, but the skill does not declare corresponding permissions. This creates a transparency and governance gap: a user or platform may not realize the skill can access secrets and perform networked actions against an external service.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The workflow instructs the agent to remove checked shopping-list items without any explicit confirmation step. Because this operation is destructive and affects user data, an accidental invocation, misread intent, or prompt manipulation could cause irreversible deletion of list items the user expected to keep.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/api.js:14