ClawHub
Back to skill

Security audit

Consensus

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Consensus search integration that uses the OOMOL oo connector for read-only paper search, with no artifact-backed evidence of hidden or destructive behavior.

Install this if you want Codex to search Consensus through your OOMOL-connected account. Be aware that first-time setup may require installing the oo CLI and connecting a Consensus API key in OOMOL; review those account and billing implications before use.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The instruction to use this skill for ANY Consensus-related request is overly broad and can cause the agent to route all relevant tasks through this skill without considering whether a more constrained or direct path is appropriate. While this skill appears read-focused and only exposes a search action, broad trigger language increases the chance of unintended invocation, tool overreach, and reduced user intent validation.

Static analysis

No suspicious patterns detected.