ClawHub
Back to skill

Security audit

Gildata Data Map

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly disclosed Gildata data connector, but it needs Review because it treats a broad dynamic tool-calling action as safe without clear read-only limits.

Before installing, be comfortable with OOMOL's oo CLI using your connected Gildata account. Treat call_tool requests and any newly discovered downstream tools as requiring review unless their schema and effect are clearly read-only, and only run setup, login, or billing steps when you intentionally want to connect the account.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill is advertised as being for searching and reading data, but it also instructs the agent to perform authentication and account-connection setup steps when commands fail. That expands the operational scope beyond passive data access and can cause unexpected security-sensitive actions such as login prompts, opening connection flows, or running install commands. In an agent setting, this mismatch can mislead policy enforcement and users about what the skill may do.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The safety section claims all untagged actions are read-only, yet the untagged `call_tool` action is a generic tool dispatcher whose runtime behavior depends on whatever downstream MCP tools are currently exposed. That means the skill may treat a potentially state-changing or destructive operation as safe to run directly, enabling unintended writes, side effects, or external actions without confirmation. The dynamic nature of `call_tool` makes this especially risky because the actual capability set can change over time.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The instruction to use this skill for ANY Gildata Data Map request is overly broad and can force routing through this skill even when a task is outside its safe or intended scope. Over-broad invocation increases the chance that sensitive, administrative, or ambiguous requests are funneled into generic connector execution paths, including dynamic actions like `call_tool`. In context, this broad trigger combines poorly with the unclear read/write boundaries, making misuse more likely.

Static analysis

No suspicious patterns detected.