ClawHub
Back to skill

Security audit

Pa Onboarding

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent onboarding guide for a personal assistant, but it asks users to grant broad account access and store a monday.com API token in plaintext without enough safety guidance.

Install only if you intend to create a PA with these integrations. Before following the setup, use least-privilege service accounts, avoid enabling Gmail/Drive/contacts unless needed, store the monday.com token in a proper secret store or a locked-down file, rotate/revoke tokens when no longer needed, and define which messages, calendar edits, workspace changes, and recurring briefings require explicit owner approval.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill instructs users to generate a monday.com API token and save it in plaintext to a predictable file path without any warning about credential sensitivity, access controls, or secret handling. This increases the chance of token leakage through shell history, file disclosure, backups, shared home directories, or accidental inclusion in logs and repositories, enabling unauthorized access to monday.com data and actions.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The calendar and email authentication steps grant access to sensitive private account data but provide no privacy notice, consent checkpoint, or scope-minimization guidance. In an onboarding context, operators may authorize broad mailbox/calendar access without understanding the exposure, leading to unnecessary collection and processing of personal or business-sensitive information.

Static analysis

No suspicious patterns detected.