ClawHub
Back to skill

Security audit

Qichacha

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Qichacha read-only connector wrapper that uses the OOMOL oo CLI and does not show hidden or destructive behavior.

Install only if you intend to let the agent query Qichacha through your OOMOL-connected account. The skill may send company lookup payloads to the OOMOL/Qichacha connector, and first-time setup may require installing the oo CLI and connecting Qichacha credentials, but the artifact does not instruct automatic login, credential extraction, persistence, or write actions.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger text is overly broad: it instructs the agent to use this skill for ANY Qichacha-related request and whenever a task involves Qichacha, which can cause automatic invocation even when the user did not explicitly intend external connector access. This increases the chance of unnecessary data access, privacy issues, or accidental execution in loosely related conversations, especially because the skill is wired to a real third-party service.

Static analysis

No suspicious patterns detected.