ClawHub
Back to skill

Security audit

Moxie

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Moxie connector helper for reading/searching CRM data through the oo CLI, with no artifact-backed evidence of hidden or destructive behavior.

Install this only if you want your agent to read/search Moxie workspace data through OOMOL. Review any request that would change or delete Moxie data, and require explicit confirmation before running actions outside the listed read-only operations.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The manifest and description frame the skill as limited to searching and reading data, but the body explicitly supports arbitrary connector actions discovered from live schema, including potential write or destructive operations. This mismatch can cause an agent or reviewer to grant the skill broader trust than warranted, increasing the chance of unintended state-changing actions in Moxie.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The skill says untagged actions are safe reads, but elsewhere instructs the agent to inspect the live connector schema and run actions generically by action name. That means newly added or undocumented actions could be executed without being reflected in the static safety guidance, creating a path to accidental or unsafe writes if the connector surface changes.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger phrase says to use this skill for ANY Moxie request, which is overly broad and can cause the agent to invoke it in situations beyond the user's intent or beyond the skill's safely described scope. In combination with the generic connector execution model, this broad routing increases the blast radius of the other design issues.

Static analysis

No suspicious patterns detected.