ClawHub
Back to skill

Security audit

Publish Confluence

Security checks for vulnerabilities and agentic risk

Overview

This looks like a Confluence API reference rather than malware, but it includes powerful admin, invite, delete, and purge actions without enough guardrails.

Install only if you want an agent to use direct Confluence Cloud API calls. Use a least-privilege Atlassian API token, avoid pasting secrets into commands or logs, and require explicit confirmation before admin-key, invite, delete, purge, redaction, or space-modifying actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest materially understates the skill's capabilities: the description advertises content management, but the body also documents privileged admin-key actions, user invitation/access operations, whiteboard management, and redaction. This scope mismatch can mislead users or higher-level agents into authorizing broader actions than expected, increasing the risk of unsafe invocation and privilege misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The authentication guidance encourages constructing Basic auth values and using credentials directly in shell commands, but omits warnings that tokens may leak via shell history, process listings, logs, or copied commands. Because the skill requires long-lived API credentials, poor handling guidance increases the likelihood of credential compromise and subsequent unauthorized Confluence access.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Get Admin Key:

bash
curl -X GET "https://$CONFLUENCE_DOMAIN.atlassian.net/wiki/api/v2/admin-key" \
  -H "Authorization: Basic <base64_auth>"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documents destructive attachment deletion, including purge=true for permanent deletion, without prominent warnings or confirmation requirements. In an agent context, this raises the chance of accidental irreversible data loss if the operation is invoked from ambiguous user requests or automation flows.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

Get All Blog Posts:

bash
curl -X GET "https://$CONFLUENCE_DOMAIN.atlassian.net/wiki/api/v2/blogposts?limit=25&space-id=123" \
  -H "Authorization: Basic <base64_auth>"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

Create Footer Comment on Page:

bash
curl -X POST "https://$CONFLUENCE_DOMAIN.atlassian.net/wiki/api/v2/footer-comments" \
  -H "Authorization: Basic <base64_auth>" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

Get Page Properties:

bash
curl -X GET "https://$CONFLUENCE_DOMAIN.atlassian.net/wiki/api/v2/pages/123456/properties" \
  -H "Authorization: Basic <base64_auth>"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.

Get All Pages in Space:

bash
curl -X GET "https://$CONFLUENCE_DOMAIN.atlassian.net/wiki/api/v2/pages?space-id=123&limit=50" \
  -H "Authorization: Basic <base64_auth>"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Page deletion is presented as a routine example without a clear warning about its impact on user data and workflows. In a skill used by agents, undocumented destructive behavior can cause unintended deletion of important Confluence content when user intent is incomplete or misinterpreted.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 430)May include surrounding context.

Get All Spaces:

bash
curl -X GET "https://$CONFLUENCE_DOMAIN.atlassian.net/wiki/api/v2/spaces?limit=50" \
  -H "Authorization: Basic <base64_auth>"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 507)May include surrounding context.

Get Page Versions:

bash
curl -X GET "https://$CONFLUENCE_DOMAIN.atlassian.net/wiki/api/v2/pages/123456/versions?limit=10" \
  -H "Authorization: Basic <base64_auth>"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 535)May include surrounding context.

Create Whiteboard:

bash
curl -X POST "https://$CONFLUENCE_DOMAIN.atlassian.net/wiki/api/v2/whiteboards" \
  -H "Authorization: Basic <base64_auth>" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.