Security audit

Countly

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Countly read-only connector wrapper with disclosed OOMOL setup requirements and no artifact-backed destructive or hidden behavior.

Before installing, confirm you are comfortable using OOMOL as the broker for your Countly connection and with installing/signing into the oo CLI if it is not already set up. The reviewed skill itself only documents read-oriented Countly actions, but users should still review live connector schemas before running actions.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest and description constrain the skill to 'searching and reading data', but the body explicitly permits arbitrary Countly actions and documents handling for state-changing operations. This mismatch can mislead downstream policy, reviewers, or users into treating the skill as read-only when it may invoke write or destructive connector actions, increasing the chance of unauthorized modification.

Intent-Code Divergence

Low

Confidence: 89% confidence
Finding: The safety section implies untagged actions are safe reads, but the execution instructions allow the agent to run any action name after fetching its schema. If the connector later exposes new write or destructive actions that are not listed or tagged here, the agent could still invoke them under the misleading assumption that only documented untagged actions are read-only.

Static analysis

No suspicious patterns detected.