ClawHub
Back to skill

Security audit

SafetyCulture

Security checks across malware telemetry and agentic risk

Overview

This SafetyCulture skill is a coherent connector wrapper with disclosed read and create-action capabilities and confirmation requirements for writes.

Install only if you are comfortable connecting OOMOL to SafetyCulture and letting the agent run oo connector actions. Review write payloads carefully before approval, especially create_action, and only run the CLI installation or login steps if you trust OOMOL's CLI and need the connector setup.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger text is intentionally broad: 'Use this skill for ANY SafetyCulture request' and 'instead of calling the API directly' can cause the agent to route all SafetyCulture-related tasks through this skill without considering narrower, safer, or more appropriate alternatives. In a skill that includes both read and write operations, overbroad routing increases the chance of accidental state-changing actions being invoked in contexts where the user only intended information retrieval or where direct, constrained API/tool usage would be safer.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.