ClawHub
Back to skill

Security audit

OOMOL Console

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OOMOL Console administration wrapper that can make account changes, but its authority is scoped to listed OOMOL Console actions with explicit confirmation gates for write and destructive operations.

Install this only if you intend to let an agent administer your OOMOL Console account through the oo CLI. Treat write and destructive actions like permission changes, member additions, and group deletion as account-impacting operations, and approve them only after reviewing the exact target and payload.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill description says to use this skill for ANY OOMOL Console request instead of calling the API directly, which is an overly broad trigger scope. This can cause the agent to route unrelated or higher-risk operations through a powerful skill with write and destructive capabilities, increasing the chance of unintended state-changing actions or use in contexts where narrower handling would be safer.

Static analysis

No suspicious patterns detected.