ClawHub
Back to skill

Security audit

Recurly

Security checks for vulnerabilities and agentic risk

Overview

The Recurly workflow is clearly scoped, but its setup runs unpinned remote installers and leaves broader agent changes outside clear user control.

Review and control CLI installation and automatic skill syncing before enabling this skill. Prefer a reviewed, pinned CLI release, connect only necessary Recurly permissions, and retain confirmation for every change. OOMOL mediates access to your business data. Remote installer contents were unavailable for inspection.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose concerns Recurly data access, but the only supplied command executes an external installer. No connection between that installer and the declared Recurly functionality is established, so this is not demonstrated to be merely a supporting implementation detail. The downloaded script's contents and any further effects cannot be determined from this chunk.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

Piping a remotely fetched installer directly into bash executes mutable third-party code with the agent process's permissions, without version pinning or independent integrity verification. A compromised distribution endpoint or malicious installer update could access local data or modify the environment; HTTPS and the legitimate setup purpose do not eliminate that supply-chain risk.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

The setup workflow executes downloaded installation scripts without warning about local system changes or third-party code execution.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The fallback instructs the agent to install software after a missing-command error without requiring approval for executing third-party code or changing the local environment. Its conditional setup context reduces exposure, but a request to operate Recurly does not necessarily authorize local software installation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.

- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.

## Resources