ClawHub
Back to skill

Security audit

Mails

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Mails integration skill that uses a constrained OOMOL CLI connector and discloses its credential, setup, and write-action behavior.

Install this only if you intend your agent to use your connected OOMOL Mails account for email validation tasks. Review write requests before approving them, especially batch validation jobs, and only run the one-time CLI install or account connection steps when you trust OOMOL and need the connector configured.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The invocation text says to use this skill for ANY Mails request and instead of calling the API directly, which is overly broad and can cause the agent to select this skill for a wide range of loosely related prompts without sufficient user intent validation. In a security-sensitive automation environment, broad routing increases the chance of unintended connector use, including write-capable actions, especially because this skill exposes state-changing operations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.