ClawHub
Back to skill

Security audit

Appcues

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly fits its Appcues automation purpose, but it under-labels an action that can change live Appcues content.

Review this skill before installing if your Appcues account controls production user experiences. Treat both publishing and unpublishing flows as state-changing actions that should require explicit confirmation, even though the artifact only marks publishing as `[write]`.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The skill documents that only actions tagged [write] or [destructive] change state, but `unpublish_flow` is listed without either tag even though it modifies publication status. This mismatch can cause an agent or operator to treat `unpublish_flow` as a safe read-like action and execute it without confirmation, leading to unintended state changes in Appcues.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The invocation text says to use this skill for ANY Appcues request and instead of calling the API directly, which is overly broad and may trigger the skill for loosely related requests without sufficient task-specific validation. In a skill that includes write operations, broad routing increases the chance of accidental activation and use of a more privileged pathway than necessary.

Static analysis

No suspicious patterns detected.