ClawHub
Back to skill

Security audit

Ozon

Security checks for vulnerabilities and agentic risk

Overview

This Ozon skill is a disclosed read-only connector for seller account data, with a minor scope wording caveat but no hidden or destructive behavior.

Before installing, be comfortable letting the agent query your connected Ozon seller account through OOMOL. Treat it as suitable for reading/searching Ozon seller data, and require separate confirmation and schema review before any future write-capable action is added.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Medium
Confidence
80% confidence
Finding
The instruction to use this skill for ANY Ozon request creates an overbroad routing rule that exceeds the documented capability set, which only includes read operations. This can cause an agent to send unrelated or state-changing Ozon tasks through a skill not designed for them, increasing the chance of incorrect behavior, unsafe fallbacks, or misuse of connected account context.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The phrase 'ANY Ozon request' is an overly broad invocation trigger that can hijack routing for all Ozon-related tasks without clear boundaries. In an agent environment, this increases the attack surface for prompt/skill misselection and may lead to execution of shell-backed connector commands in contexts where the skill is not the safest or most appropriate tool.

Static analysis

No suspicious patterns detected.