ClawHub
Back to skill

Security audit

CoderPad

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent CoderPad integration that uses the OOMOL CLI with disclosed read and create-pad actions.

Install this only if you intend to let the agent access CoderPad data through your OOMOL-connected account. Review create_pad payloads before approving them, and remember that read actions can expose organization, pad, question, and event data from CoderPad.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger text instructs the agent to use this skill for ANY CoderPad-related request, which is broader than the concrete action list and can cause the skill to be selected for requests that need additional policy checks, narrower tooling, or direct user confirmation. In a capability-bearing integration, overly broad routing increases the chance of unintended data access or state-changing operations being invoked under an umbrella assumption that all CoderPad tasks belong here.

Static analysis

No suspicious patterns detected.