ClawHub
Back to skill

Security audit

Rippling

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Rippling read-only connector skill, but users should understand it can access employee and company data through their connected OOMOL account.

Install only if you trust OOMOL and intend your agent to read Rippling HR/company data through your connected account. Review the Rippling API scopes granted to OOMOL, because list_workers and get_worker may expose sensitive employee information. Do not connect broader Rippling scopes than needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The skill uses an overly broad routing instruction — 'Use this skill for ANY Rippling request' — which can cause an agent to invoke this skill indiscriminately instead of considering narrower, safer, or more appropriate alternatives. In a security context, broad trigger language increases the attack surface for unintended data access because any task merely mentioning Rippling may be routed into a capability that can query connected enterprise HR data.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.