ClawHub
Back to skill

Security audit

Braze

Security checks for vulnerabilities and agentic risk

Overview

This Braze skill is a disclosed OOMOL CLI connector for reading campaign and Canvas data, with some broad wording that users should treat carefully.

Install this only if you trust OOMOL to broker your Braze connection and you want agents to read Braze campaign and Canvas information through the oo CLI. Before approving any action not shown in the listed read-only actions, require the agent to show the exact action name, payload, and expected effect.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The manifest and top-level description present this as a read/search-only Braze skill, but the body explicitly describes a generic mechanism for invoking any Braze action and even discusses handling [write] and [destructive] operations. That mismatch can cause an agent or reviewer to trust the skill as read-only when it actually enables state-changing operations, increasing the risk of unauthorized modifications in Braze.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The safety section implies untagged actions are safe reads, but elsewhere the skill supports arbitrary action execution and merely relies on tags to distinguish writes and destructive actions. In a skill advertised as search/read focused, this creates a misleading trust boundary: omission, mislabeling, or future expansion of actions could let unsafe operations be treated as safe.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger condition says to use this skill for ANY Braze request and instead of calling the API directly, which is overly broad for a connector that can invoke arbitrary actions. Broad routing increases the chance that unrelated, sensitive, or higher-risk Braze tasks are funneled through this skill without sufficient capability scoping or user awareness.

Static analysis

No suspicious patterns detected.