ClawHub
Back to skill

Security audit

TOTP Authenticator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed OOMOL connector wrapper for generating TOTP codes, with some sensitive-use caveats but no evidence of deception or unrelated behavior.

Install this only if you want your agent to generate TOTP codes through your connected OOMOL account. Treat generated codes like passwords, and do not use the skill for general TOTP research or setup questions unless you intend to access the connector.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill description uses an absolute trigger phrase — 'Use this skill for ANY TOTP Authenticator request' and 'instead of calling the API directly' — which is broad enough to route all TOTP-related tasks through this skill without regard to user intent or least-privilege selection. Even though the listed action is read-like, the overbroad routing can cause unintended invocation, schema inspection, or code generation actions in contexts where the user did not explicitly ask to use this connector, increasing the chance of accidental secret handling or unnecessary external service access.

Static analysis

No suspicious patterns detected.