ClawHub
Back to skill

Security audit

OpenMerch People Search

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed OpenMerch people-search skill that uses a paid API key and returns normalized, obfuscated people results, with no evidence of hidden execution or persistence.

Install only if you are comfortable sending company-domain and role-search queries to OpenMerch and spending OpenMerch account credits. Keep OPENMERCH_API_KEY private, leave OPENMERCH_BASE_URL at the default unless you trust the endpoint, and treat returned people data as sensitive even when last names are obfuscated.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill is advertised as a people-search tool that returns only obfuscated profile data, but it is configured to execute the job type "people_enrichment_v1". That mismatch can cause the agent to invoke a more sensitive data-retrieval workflow than the user or platform expects, potentially exposing richer personal data and violating least-privilege and data-minimization assumptions.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The header comments describe a restricted people-search flow, but the actual configuration points to an enrichment workflow. Misleading documentation around a data-accessing skill is dangerous because reviewers, operators, and downstream agents may approve or invoke it under false assumptions about what data is being requested and what backend capability is being exercised.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
examples.md:19

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:48