ClawHub
Back to skill

Security audit

Glyphic

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only Glyphic connector wrapper, with no evidence of hidden behavior or data exfiltration.

Install this only if you want Codex to read Glyphic business data through your OOMOL-connected account. Be aware it can retrieve sensitive call transcripts, summaries, media metadata, insights, tags, and playbooks, and setup may require installing and signing into the oo CLI.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The manifest description says to use this skill for "ANY Glyphic request" and to prefer it instead of calling the API directly, which is an overly broad invocation trigger. This can cause the agent to route all Glyphic-related tasks through a shell-enabled skill without sufficient narrowing, increasing the chance of unnecessary tool execution, overcollection of data, or misuse in contexts where a more constrained path would be safer.

Static analysis

No suspicious patterns detected.