ClawHub
Back to skill

Security audit

Sensibo

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Sensibo connector that can read device data and update AC state through OOMOL, with confirmation required before writes.

Install only if you intend to let an agent operate your Sensibo account through OOMOL. Review the `oo` CLI installation path, connect only the intended Sensibo account, and confirm the exact device and AC state before approving any write action.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The skill description says to use this skill for ANY Sensibo request and instead of calling the API directly, which creates an overly broad routing rule. That can cause the agent to invoke a state-changing integration in situations where a narrower, safer, or more context-specific path would be preferable, increasing the chance of unintended access or writes.

Static analysis

No suspicious patterns detected.