ClawHub
Back to skill

Security audit

outlit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Outlit customer-intelligence helper with clearly disclosed data access and workspace-change capabilities, though users should prefer safer package-managed install paths over the documented curl-to-bash installer.

Install through npm or Homebrew instead of piping a downloaded script into bash when practical. Before enabling write grants, confirm that the agent should be allowed to change Outlit workspace access, destinations, integrations, activation, settings, Features, or customer identity records; customer merges are explicitly irreversible and should only be run after reviewing the preview and granting clear authorization.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill recommends installing software with a remote script fetched over the network and immediately executed via shell. If the hosting domain, transport, build pipeline, or script contents are ever compromised, an agent or user could execute arbitrary code on the local system with the current user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

Install the CLI:

bash
curl -fsSL https://outlit.ai/install.sh | bash
# Alternatives:
npm install -g @outlit/cli
brew install outlitai/tap/outlit

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Piping downloaded content directly into bash eliminates the user's opportunity to inspect or verify what will run and creates a classic command-chaining abuse pattern. In an agent setting, this is more dangerous because automated workflows may execute the command non-interactively, turning a documentation snippet into immediate arbitrary code execution if the remote source is malicious or tampered with.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

Install the CLI:

bash
curl -fsSL https://outlit.ai/install.sh | bash
# Alternatives:
npm install -g @outlit/cli
brew install outlitai/tap/outlit

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

Interactive setup negotiates capabilities first. It can securely prompt for a credential, open a validated browser handoff, or ask the user to confirm a CRM or Mixpanel mapping.

Do not ask the user to paste provider secrets into chat. Do not put secrets in model-visible tool calls, command arguments, logs, shell history, or process listings. When automation must supply provider configuration, have the user run the command in a trusted local terminal and send one strict JSON object through stdin:

bash
printf '%s\n' '{"credentials":{"apiKey":"<provider-api-key>"}}' \

Static analysis

No suspicious patterns detected.