ClawHub
Back to skill

Security audit

Businessmap

Security checks for vulnerabilities and agentic risk

Overview

The skill requires approval for Businessmap changes, but its automatic setup can run unverified downloaded code on your computer.

Review the setup fallback before installing. Prefer installing a verified CLI release yourself and requiring separate approval for future installation changes. Review its bundled-skill installation behavior and use a narrowly scoped Businessmap key. OOMOL mediates account access; the downloaded installers and hosted connector implementation were unavailable for inspection. No artifact-backed malicious behavior was established.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The supplied code performs remote software installation rather than any demonstrated Businessmap operation. Although dependency installation can be a supporting implementation detail, the supplied content establishes no relationship between this Oomol installer and the declared Businessmap functionality. The downloaded script's contents and subsequent effects are not available for assessment.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

Piping an unpinned HTTPS response directly into bash executes the remote endpoint's current contents without prior inspection or integrity verification. Compromise of the installer hosting or publishing pipeline could therefore produce code execution with the agent's local permissions. The legitimate dependency-installation purpose reduces suspicion of malicious intent, but not the supply-chain exposure.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

The fallback setup executes downloaded installation scripts without warning about running remote code or modifying the local system.

Medium
Category
Output Handling
Confidence
94% confidence
Finding

The fallback directs the agent to execute remotely downloaded shell or PowerShell code without a separate approval step for local installation. Authorization to operate Businessmap does not necessarily authorize arbitrary local code execution, and a compromised installer could access files and credentials available to the agent's OS account. The missing-CLI condition limits when this occurs but does not limit installer privileges.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.

- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.

## Resources