ClawHub
Back to skill

Security audit

Mendeley

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Mendeley connector wrapper that can read and change a user's library, with explicit confirmation required for write and delete actions.

Install only if you want your agent to use OOMOL's oo CLI with your connected Mendeley account. Review payloads before approving create, update, or delete actions, and be cautious with the one-time CLI installer if it is not already present.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill description instructs the agent to use this skill for ANY Mendeley request, which creates an overly broad routing trigger. That can cause unintended invocation on ambiguous user prompts, increasing the chance of unnecessary access to connected Mendeley data or accidental write/destructive operations being placed in the execution path.

Static analysis

No suspicious patterns detected.