ClawHub

AppVeyor

Security checks across malware telemetry and agentic risk

Overview

This AppVeyor skill is a disclosed read-oriented OOMOL connector wrapper, with some setup and credential-use caveats but no artifact-backed malicious behavior.

Install this only if you intend to let an agent read AppVeyor data through your OOMOL-connected account. Review the AppVeyor token scopes because the skill can list team users, roles, environments, projects, and build artifacts visible to that token. If the `oo` CLI is not already installed, prefer verifying OOMOL's official installation instructions before running the provided remote installer command.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The manifest description uses a blanket activation condition: "Use this skill for ANY AppVeyor request." For a markdown/manifest file, this is an ambiguous and overly broad trigger because it does not define boundaries, exclusions, or negative examples for when the skill should not activate.

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
90% confidence
Finding
curl -fsSL https://cli.oomol.com/install.sh | bash

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal