ClawHub
Back to skill

Security audit

WhatsAble

Security checks for vulnerabilities and agentic risk

Overview

The messaging workflow has clear approval rules, but setup executes unverified downloaded code without a separate approval step for local changes.

Before allowing setup, review and verify a chosen CLI release and its automatic agent-skill installation behavior. Message contents and attachment URLs pass through OOMOL; confirm the recipient and payload before each send. The installer contents were unavailable for inspection, so their precise local effects remain unverified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The supplied command installs software from an external service rather than performing WhatsAble data operations. Nothing in the supplied chunk establishes this installation as a supporting dependency for WhatsAble. The remote script's contents and any further effects are not available for assessment.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

Piping an HTTPS response directly into bash executes mutable remote code with the agent process's local privileges, without a pinned version or independent integrity check. A compromised distribution endpoint could therefore modify local files or steal accessible secrets; the conditional setup path reduces exposure but does not remove this supply-chain risk.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Fallback setup executes downloaded installer scripts without warning about system changes or remote-code execution.

Medium
Category
Output Handling
Confidence
94% confidence
Finding

The missing-CLI fallback directs the agent to execute downloaded installation scripts without explaining their execution privileges or obtaining approval for local system changes. Although prerequisite installation is legitimate, treating it as an automatic recovery step can turn an ordinary WhatsAble request into unreviewed execution of externally controlled code.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.

- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.

## Resources