Security audit

opphub

Security checks across malware telemetry and agentic risk

Overview

The skill has a real OppHub purpose, but it grants and normalizes broad token, cron, local-memory, file-upload, and production-ops access that is not clearly scoped for users.

Review before installing. Use this only in a workspace where OppHub may receive company profiles, contract-derived data, and search-derived content. Avoid running discovery against private memory/wiki sources unless you explicitly want that context used. The publisher should remove bundled production docs/secrets, redact token diagnostics, add explicit upload and cron confirmations, and document exactly what leaves the device.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (68)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill declares no explicit permissions while the documented behavior clearly requires network access, shell execution, and environment interaction. This weakens informed consent and review because users and operators cannot accurately assess the skill’s effective privilege and data exposure before installation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The published description frames the skill as account connection, company intake, and notifications, but the documented/observed behavior extends into token lifecycle management, cron installation, plugin/version management, knowledge-base search and ingestion, document parsing, and conflict handling. This mismatch is dangerous because it obscures the true operational scope, including persistence, data processing, and external transmission of potentially sensitive business information.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The script goes beyond simple cron setup by discovering recipient identities from local credential files, reading a keychain token, and contacting a remote API to derive delivery targets. That broader secret and identity discovery is not obvious from the user-facing purpose of 'setup a daily cron job', which creates a privacy and consent gap and expands the blast radius if the script is run in a privileged local environment.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The plan includes SCP, SSH, container build, restart, and production verification steps against an ECS host, which go beyond describing a local bug-fix workflow and grant remote administrative capability. Embedding deployment and remote ops instructions inside a skill increases the chance an agent will perform privileged actions on live infrastructure without separate approval gates or environment checks.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The plan instructs direct SSH access to a live host and database inspection using Prisma to enumerate records for a specific account, which exposes production data access patterns not necessary for a general coding skill. Even if intended for debugging, this normalizes privileged access and can leak sensitive business data or enable misuse if the skill is invoked in the wrong environment.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The plan explicitly creates a server-side JWT with `isAdmin: true` and also relaxes ws-server authorization to allow cross-user pushes based on a broad `SYSTEM_TRIGGERS` allowlist. This expands privilege well beyond the described push workflow: if the shared secret is weak, leaked, or reused, an attacker or compromised service could forge privileged tokens and send messages to arbitrary users, undermining authorization boundaries.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The architecture explicitly expands the skill from account setup and message delivery into broad company profiling, knowledge-base creation, and capability inference. That materially changes the data-access scope and creates a surveillance-style collection path unrelated to the core task of connecting an OppHub account and configuring push delivery.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: This section directs the skill to read unrelated local workspace artifacts such as SOUL.md, USER.md, MEMORY.md, daily logs, and wiki content to infer the user's profile and capabilities. Those files can contain sensitive personal, business, and project information far beyond what is needed for OppHub configuration, so collecting and synthesizing them creates a serious privacy and data-minimization violation.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The design adds active web search, URL fetching, image/PDF parsing, and chat-context extraction to build a profile that is not necessary for login/configure/push functionality. Combining multiple enrichment channels increases the amount of collected data and the chance of pulling in sensitive or inaccurate third-party information, which is then normalized into a server-side knowledge base.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The privacy boundary claims say the skill only handles public information and avoids private user data, but elsewhere the document instructs analysis of recent chat history and local memory artifacts. These conflicting claims create misleading user expectations and weaken meaningful consent, making covert overcollection more likely.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The example flow mixes a public-channel interaction with later private submission of the 6-digit verification code, while the document itself warns that codes must not be posted in public chat. In a chat-driven registration skill, contradictory guidance increases the chance that users or implementers expose OTPs in shared channels, enabling account takeover during the registration window.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The notes disclose production infrastructure access details including host IP, privileged username, filesystem paths, and deployment topology. Even without the private key itself, this materially lowers the effort for an attacker who gains partial access elsewhere, enabling targeted intrusion, privilege abuse, or more convincing social engineering against production systems.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The notes explicitly state that production secrets were used for end-to-end testing, which normalizes unsafe secret handling and indicates real credentials may be accessible in non-secret documentation. In this file that suspicion is confirmed by the adjacent hard-coded secret, creating immediate risk of unauthorized authentication against production services.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill description does not clearly warn users that company data and uploaded contract files may be sent to external OppHub services for parsing, matching, and storage-related operations. That creates a privacy and confidentiality risk because users may submit proprietary or regulated business data without understanding it leaves the local environment.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code reads local credential files under ~/.openclaw/credentials to infer a default recipient without any disclosure or confirmation in this file. Silent access to locally stored identity data is dangerous because it can expose private account mappings and cause messages or automation to target unintended users.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script sends a bearer access token to an external service endpoint to retrieve channel metadata, but there is no user-facing warning or consent flow around that transmission. Forwarding locally retrieved credentials to a remote server is sensitive because compromise, logging, or misuse of that endpoint could expose the token and allow account actions beyond cron setup.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: When --file is used, the script reads the local file and sends its full contents to a remote API endpoint without any interactive confirmation, warning, or restriction on file paths/content types. In an agent/skill context, this creates a real exfiltration risk because a caller can cause sensitive local files to be uploaded under the user's authenticated session, especially if the user does not clearly understand that local file contents are being transmitted off-host.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code parses rawText into structured company metadata including legal person, credit code, address, city, team size, and business description, then packages those values with source metadata for downstream use. Even though this is core functionality, there is no notice, consent, minimization, or sensitivity check before extracting and retaining potentially sensitive business or personal data, which creates privacy and unintended-data-processing risk if rawText contains confidential content.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The global prompt directs the downstream LLM workflow to rewrite card content and then invoke a submission command with the completed cards, effectively encouraging transmission of parsed rawText-derived content without user review or confirmation. In this skill context, the cards include free-text descriptions and extracted business data, so automatic submission can leak confidential company information or inaccurate machine-generated content to external systems.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly directs the agent to query local memory and wiki sources containing historical data, but the CLI output and workflow provide no user-facing notice, consent, or data-minimization controls. This can cause retrieval and downstream reuse of prior local information about a company or related conversations without the user understanding that internal historical context is being searched and incorporated.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The generated workflow mandates external web searches for company information and instructs the agent that these searches 'must' be performed, yet there is no user-facing disclosure that queries containing the target company name will be sent to external services. This creates a privacy and data-handling risk because user-supplied entities or investigation targets may be exposed to third-party search providers without informed consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Auto mode retrieves a live access token and prints its length plus the last 12 characters to stdout. Even partial token disclosure can leak sensitive material into shell history, logs, CI output, agent transcripts, or observability pipelines, materially increasing the chance of credential misuse if the token format or surrounding context aids reconstruction or correlation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The design explicitly sends a token-derived identity (`opcId` decoded from the access token) together with raw user/company content to a remote API endpoint, but the flow does not mention user notice, consent, data minimization, or privacy controls. In a skill that ingests company knowledge and account-linked data, this creates a real privacy and trust boundary risk: sensitive business content may be transmitted off-process or off-device without clear disclosure or safeguards.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The plan includes production-affecting deployment commands such as direct SCP to an ECS host, in-place remote builds, and container restarts, but does not include approval gates, rollback steps, maintenance warnings, or environment-safety checks. In an agentic skill context, this is dangerous because an automated worker could execute disruptive production changes immediately, causing downtime, bad deployments, or uncontrolled configuration drift.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The plan includes direct `scp`, `ssh`, Docker build, and container restart commands against a named remote host without any production-safety warning, approval gate, rollback step, or environment validation. In an agent-executed workflow, this increases the risk of unintended deployment, service interruption, or overwriting live code on infrastructure from a planning document alone.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bin/opphub-cron-setup.js:42

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bin/opphub-knowledge-ingest-batch.js:160

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bin/opphub-knowledge-match.js:118

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bin/opphub-oauth-login.js:112

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: bin/opphub-knowledge-submit.js:49

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: lib/opphub-plugin-client.js:176

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: docs/server-schema-v32-design.md:316

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: tests/e2e-verify.js:308