ClawHub
Back to skill

Security audit

Luno

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Luno connector skill for OOMOL-backed account and market reads, with some broad wording and conservative mislabeling that users should notice before installing.

Install only if you are comfortable letting the agent query your Luno information through OOMOL. Treat balance and order reads as sensitive financial data, and require explicit confirmation before any future connector action that would place, cancel, transfer, or otherwise change funds.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill labels clearly read-only actions like `get_order` and `get_top_order_book` as `[write]`, which misrepresents their behavior and can distort downstream safety decisions. Incorrect action classification in a financial skill is dangerous because agents or reviewers may rely on these tags to decide when confirmation is needed, leading to either unsafe execution policies or operator confusion about what actually changes account state.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The phrase 'Use this skill for ANY Luno request' is overly broad and encourages indiscriminate invocation for all Luno-related tasks, regardless of whether the skill is necessary or the request is high-risk. In a finance context, broad routing language increases the chance that sensitive trading or account operations are funneled through the skill without sufficient task-specific checks, confirmation logic, or safer alternatives.

Natural-Language Policy Violations

Low
Confidence
80% confidence
Finding
The instruction to use this skill instead of calling the API directly forces all Luno-related handling through one path without user opt-in or contextual evaluation. While not inherently malicious, this can suppress safer alternatives, reduce transparency, and make it easier for an agent to overuse the skill in situations where only explanation, planning, or non-executing guidance was needed.

Static analysis

No suspicious patterns detected.