ClawHub
Back to skill

Security audit

MyOTP.App

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it under-labels security-sensitive OTP actions that can generate, extend, or verify authentication codes.

Review this skill before installing. It should be treated as capable of sending, extending, and verifying OTPs through the connected MyOTP.App account, not just reading reports or statuses. Only use it where agents must get explicit confirmation for OTP-generation, extension, or verification payloads.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The manifest and description present the skill as suitable for 'searching and reading data,' but the documented actions include OTP generation, extension, and verification, which are operational and potentially security-sensitive. This mismatch can mislead an agent into invoking state-changing or authentication-related actions under a read-only trust model, increasing the chance of unauthorized OTP issuance or workflow abuse.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The safety section states that untagged actions are reads, yet untagged actions such as generate_otp, extend_otp, and verify_otp are not passive reads and can affect authentication flows or system state. This creates a dangerous false safety signal that may cause an agent to run sensitive OTP operations without confirmation or heightened scrutiny.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The invocation guidance says to use this skill for ANY MyOTP.App request, without constraining which tasks are appropriate or distinguishing low-risk lookups from high-risk OTP actions. In context, this broad trigger is more dangerous because the skill exposes authentication-related operations, so casual mentions of MyOTP.App could route an agent into running sensitive commands too readily.

Static analysis

No suspicious patterns detected.