ClawHub
Back to skill

Security audit

pretix

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed pretix connector that uses the OOMOL oo CLI to read ticketing data, with some documentation scope issues users should notice.

Install this only if you intend to let an agent use your OOMOL-connected pretix account to access organizer, event, item, and order information. Check the live connector schema before use, confirm any action that could change pretix data, and be aware that the skill's description is broader than the documented action list.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill labels `get_order` as `[write]` even though it is described as a read operation. Misclassifying operation safety can cause the agent to apply the wrong confirmation policy, creating operator confusion and undermining trust in the skill's safety model. In a connector skill that accesses production ticketing and order data, inaccurate safety labels increase the chance of unsafe automation decisions.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The description instructs the agent to use this skill for "ANY pretix request" and instead of calling the API directly, which creates an overly broad routing rule without exclusions or guardrails. That broad scope can force sensitive or unsupported tasks through this skill, reducing opportunity for per-task security checks and making misuse of connected credentials more likely. The risk is elevated because the skill can access real pretix organizers, events, items, and orders via server-side injected credentials.

Static analysis

No suspicious patterns detected.