ClawHub

Plisio

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Plisio connector for reading account data and creating invoices through OOMOL, with setup and financial-use cautions users should review.

Install this only if you intend to connect Plisio through OOMOL and are comfortable with the agent reading balances/operations and creating invoices after confirmation. Run the oo CLI installer only after verifying OOMOL's install source, and review every invoice payload before approving it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The description says to use this skill for "ANY Plisio request," covering reading, creating, and updating data without narrowing scope or giving exclusions. This broad phrasing can overlap with many ordinary requests involving Plisio and does not specify boundaries or negative examples for when the skill should not activate.

External Script Fetching

High
Category
Supply Chain
Content
- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell
Confidence
90% confidence
Finding
curl -fsSL https://cli.oomol.com/install.sh | bash

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal