ClawHub
Back to skill

Security audit

SamCart

Security checks for vulnerabilities and agentic risk

Overview

This SamCart skill appears purpose-aligned, but it needs review because it combines sensitive commerce-account access with broad routing instructions and unverified remote install commands.

Install only if you trust OOMOL and are comfortable connecting SamCart through its service. Review installer source or use a safer verified installation path before running the setup commands, and treat customer, order, and subscription reads as sensitive business-data access.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The action list labels `get_order` as `[write]` even though its description says it only retrieves an order. This kind of safety-tag mismatch can cause an agent or user to misunderstand the operation’s risk, either treating a read as state-changing or, more dangerously in similar cases, normalizing inaccurate safety metadata and undermining confirmation safeguards. In this skill context, the danger is moderate because the documented command still appears to be a read, but the contradictory metadata weakens trust in the skill’s safety model.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The phrase 'Use this skill for ANY SamCart request' is overly broad and instructs the agent to route all SamCart-related work through this skill without regard to least privilege, task suitability, or safer alternatives. Broad invocation language increases the chance the skill is used automatically in higher-risk situations, including write operations or troubleshooting flows that may expose users to additional commands. In this context, the skill can trigger shell-based connector usage, so overbroad routing meaningfully expands the attack surface.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The first-time setup section recommends `curl ... | bash` and PowerShell `irm ... | iex`, which execute remote code directly in the user’s shell without any integrity verification or warning. If the install endpoint, network path, or hosting account is compromised, this becomes a straightforward remote code execution path on the user’s machine. The skill context makes this more dangerous because the commands are presented as operational guidance for fixing failures, which users or agents may follow under pressure during setup.

Static analysis

No suspicious patterns detected.