ClawHub
Back to skill

Security audit

OpenCage

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward OpenCage connector with disclosed setup and credential use, though users should understand it relies on OOMOL and the oo CLI.

Install this only if you intend to use OpenCage through an OOMOL-connected account. Review the oo CLI installation path and understand that geocoding inputs will be sent through the OOMOL/OpenCage integration; no artifact evidence indicates malicious behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
82% confidence
Finding
The instruction to use this skill for ANY OpenCage request is overly broad and can cause automatic routing of loosely related tasks into this skill without sufficient validation. In an agentic environment, broad trigger text increases the chance of unintended invocation, tool overreach, or misuse of connected credentials, especially when paired with shell access.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.