ClawHub
Back to skill

Security audit

tella-cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Tella workspace CLI helper, with sensitive capabilities that fit its stated video, transcript, playlist, and webhook management purpose.

Install this only if you want an agent to operate your Tella workspace. Use a least-privileged Tella API key where possible, avoid exposing API keys or webhook secrets in chat or logs, and require explicit confirmation for deletes, collaborator changes, sharing changes, exports, and webhook secret retrieval.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill explicitly exposes a command to retrieve webhook signing secrets but provides no guidance to treat the output as sensitive or avoid logging, echoing, or passing it downstream. In an agent context, secrets can be inadvertently surfaced in chat output, stored in logs, or reused by other tools, which could enable webhook spoofing or broader compromise of integrations.

Missing User Warnings

Low
Confidence
75% confidence
Finding
The skill promotes transcript retrieval without noting that transcripts may contain sensitive spoken information such as credentials, personal data, or confidential business content. In an agent workflow, this increases the risk of oversharing or transmitting sensitive transcript text to unintended downstream consumers.

Static analysis

No suspicious patterns detected.