ClawHub
Back to skill

Security audit

Logo.dev

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Logo.dev connector helper with read-oriented actions and no artifact evidence of hidden or destructive behavior.

Install this if you want Codex to use your OOMOL-connected Logo.dev account for brand and logo lookups. Treat first-time CLI install, login, provider connection, and billing steps as user-approved setup actions, and do not provide credentials directly in chat.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The skill includes instructions to install software, authenticate, and direct the user to connection/billing URLs even though its stated purpose is handling Logo.dev data requests. In an agentic context, this broadens the skill from data access into environment modification and account-affecting actions, which can trigger unnecessary privileged operations or social-engineering-like workflow expansion.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The invocation text says to use this skill for 'ANY Logo.dev request,' which is overly broad and may cause the agent to select it in situations where direct API use, manual reasoning, or a narrower skill would be more appropriate. Overbroad routing increases the chance of unnecessary tool execution and exposure to the setup/install/auth flows embedded in the skill.

Static analysis

No suspicious patterns detected.