ClawHub
Back to skill

Security audit

Kommo

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed read-only Kommo connector that uses OOMOL's CLI and does not show hidden, destructive, or exfiltrating behavior.

Install this only if you want your agent to read data from your connected Kommo account through OOMOL. Be aware that CRM records such as contacts, leads, companies, users, and tasks can contain sensitive business or personal information, and review any first-time CLI install or account-connection step before running it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrase instructs the agent to use this skill for ANY Kommo-related request, which is broader than the actual capability described later in the file. Overbroad routing can cause unintended invocation for vague mentions of Kommo and may bypass safer or more precise handling paths, especially if a user only references Kommo incidentally.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.