ClawHub
Back to skill

Security audit

EasyPost

Security checks across malware telemetry and agentic risk

Overview

This EasyPost skill is a coherent connector that uses the OOMOL `oo` CLI for disclosed EasyPost read and write actions, with user confirmation required for writes.

Install this only if you intend to let Codex use your OOMOL-connected EasyPost account. Review payloads before approving create actions, since they can create account records, and only follow the CLI setup steps if you trust OOMOL's `oo` CLI and need it installed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill description instructs the agent to use this skill for ANY EasyPost request and whenever a task involves EasyPost, which is an overly broad trigger. This can cause the skill to activate on incidental mentions of EasyPost or on requests where direct reasoning or a narrower skill would be more appropriate, increasing the chance of unintended external actions or unnecessary exposure of connected-account data.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.