ClawHub
Back to skill

Security audit

PayPal

Security checks for vulnerabilities and agentic risk

Overview

This PayPal skill is coherent, but it under-labels some money-moving actions in a way that could let an agent run captures, refunds, or voids without the intended confirmation.

Review this skill before installing and require explicit confirmation for every PayPal action that captures funds, refunds money, voids an authorization, creates an order, or changes tracking. Treat untagged actions as not automatically safe until the action list is corrected.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The skill’s safety section states that untagged actions are read-only, but the listed untagged actions include state-changing payment operations such as capture_authorization, refund_capture, and void_authorization. This can cause an agent to execute financially impactful actions without the confirmation guardrails normally required for writes, creating a real risk of unauthorized captures, refunds, or voids.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The instruction to use this skill for ANY PayPal request is overly broad and lacks scope limits, exclusions, or decision criteria. In a payment context, this increases the chance that an agent will route sensitive, ambiguous, or high-risk financial operations through the skill by default, even when additional validation or a narrower workflow should apply.

Static analysis

No suspicious patterns detected.