ClawHub
Back to skill

Security audit

DeutschlandGPT

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward DeutschlandGPT connector with disclosed account setup, scoped CLI usage, and explicit confirmation requirements before write actions.

Install this only if you want Codex to use your OOMOL-connected DeutschlandGPT account. Review payloads before approving chat completion or embedding creation because those actions may send your provided content to the service and may consume account credits.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The description instructs the agent to use this skill for 'ANY DeutschlandGPT request,' which is an overly broad trigger that can override normal tool-selection judgment and route all related tasks through a single connector without checking whether it is necessary, least-privileged, or user-intended. In this context, the skill supports both read and write operations, so broad automatic invocation increases the risk of unnecessary external data disclosure or unintended state-changing calls.

Static analysis

No suspicious patterns detected.