ClawHub
Back to skill

Security audit

Parma

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Parma connector that can read and change Parma data, with explicit confirmation required for write and destructive actions.

Install this only if you want an agent to access your connected Parma workspace. Review write or delete payloads carefully before approving them, especially relationship deletions, group removals, note updates, and contact updates.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill description uses an overly broad routing instruction: 'Use this skill for ANY Parma request,' which can cause an agent to invoke this capability indiscriminately for all Parma-related tasks. In a skill that includes write and destructive actions, broad triggering increases the chance of unintended state-changing operations being selected when a narrower, task-specific decision should be made.

Static analysis

No suspicious patterns detected.