ClawHub
Back to skill

Security audit

Vonage

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Vonage connector skill with disclosed read and SMS-send capabilities and explicit confirmation required for writes.

Install this only if you trust OOMOL to mediate access to your Vonage account. Treat send_sms as a real account action that can contact recipients or incur costs, and confirm recipient, message body, and effect before allowing it.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger description is overly broad because it instructs the agent to use this skill for ANY Vonage-related request, including reading, creating, and updating data. This can cause unintended invocation in situations where a narrower or safer workflow would be more appropriate, increasing the chance of unnecessary access to connected account data or accidental execution of write-capable actions.

Static analysis

No suspicious patterns detected.