ClawHub
Back to skill

Security audit

Vultr

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent Vultr connector skill that can manage real cloud resources, including creating or deleting servers, but it discloses those powers and requires confirmation for state-changing actions.

Install this only if you want the agent to administer your Vultr account through OOMOL. Review every proposed create, update, power, or delete action carefully, especially anything that can incur charges or permanently remove a VPS, and verify the oo CLI installer source if setup is needed.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The activation text is extremely broad: it instructs use of this skill for ANY Vultr-related request, including read, write, and destructive operations. In an agentic system, this can cause the skill to be invoked in situations where a narrower, safer path should be used, increasing the chance of unintended state-changing or destructive actions being routed through a high-privilege connector.

Static analysis

No suspicious patterns detected.