ClawHub
Back to skill

Security audit

Octopus Deploy

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Octopus Deploy read-only connector wrapper, with credentials handled through OOMOL rather than embedded in the skill.

Install this only if you want Codex to read Octopus Deploy data through your OOMOL-connected account. Review the OOMOL connection scopes and remember that visible deployments, projects, spaces, tasks, and related metadata may be returned to the agent; no state-changing Octopus actions are listed in this artifact.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill description and repeated instructions claim this skill should be used for ANY Octopus Deploy request, which creates an overly broad routing rule. That can cause an agent to invoke this skill for unrelated or higher-risk Octopus Deploy tasks without sufficient narrowing, review, or least-privilege checks, increasing the chance of inappropriate data access or unsafe operational use if the skill later gains broader actions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.