ClawHub
Back to skill

Security audit

CircleCI

Security checks for vulnerabilities and agentic risk

Overview

This CircleCI skill is coherent and disclosed: it uses OOMOL's `oo` CLI to read CircleCI data and trigger pipelines with confirmation.

Install only if you trust OOMOL to broker access to your CircleCI account. Review the requested CircleCI action payload before approving `trigger_pipeline`, and treat project artifacts and environment-variable listings as potentially sensitive even when values are masked.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.