ClawHub
Back to skill

Security audit

Bugsnag

Security checks across malware telemetry and agentic risk

Overview

This Bugsnag skill is mostly coherent and read-only, but its setup instructions include a remote installer run directly in a shell.

Review before installing. Use this only if you trust OOMOL and want Codex to query Bugsnag through that account. Prefer installing the `oo` CLI through a verified guide or package manager, and do not run the remote shell installer unless you have reviewed and trust it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The skill instructs users to install the oo CLI by piping a remotely fetched script directly into a shell (`curl ... | bash` / PowerShell `iex`). This creates a supply-chain and arbitrary code execution risk: if the install endpoint, transport, or publishing process is compromised, the user may execute attacker-controlled code in their local environment.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.