ClawHub

Easy Projects

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Easy Projects connector, but it gives an agent broad authenticated ability to change business data without enough built-in confirmation guidance.

Install only if you trust Membrane and are comfortable connecting the selected Easy Projects account. Use a least-privileged Easy Projects account where possible, ask the agent to confirm exact records and payloads before create/update/proxy operations, and be especially cautious with any non-GET proxy request because it may change or delete production data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The documentation advertises create and update actions against a live project-management system without warning that these operations can modify remote data. In an agent setting, this increases the chance of unintended writes, project changes, or record creation when the user may have expected read-only assistance.

Missing User Warnings

High
Confidence
95% confidence
Finding
The proxy request section enables arbitrary HTTP requests to the live Easy Projects API and lists destructive methods like POST, PUT, PATCH, and DELETE without any safety warning. This materially expands the skill's power beyond curated actions and can lead to unauthorized or accidental bulk changes, deletions, or other high-impact state modifications.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal