ClawHub
Back to skill

Security audit

Xata

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Xata connector helper with read-oriented listed actions and no hidden code, but users should confirm any action that could change or delete Xata data.

Install only if you trust OOMOL and want agents to access your Xata account through the oo CLI. Review any connector action before it runs, especially if the live schema or user request involves creating, updating, deleting, or overwriting data.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The manifest says this skill is for 'searching and reading data', but the body explicitly allows arbitrary Xata connector actions and describes how to handle write and destructive operations. This mismatch can cause an upstream agent or user to classify the skill as read-only and invoke it in contexts where state-changing capability should have been excluded or separately gated.

Intent-Code Divergence

Low
Confidence
89% confidence
Finding
The skill tells the agent to run any action name after inspecting the live schema, while the safety section implies that untagged actions are reads based on a non-authoritative action list in the document. If the connector exposes additional actions not listed here, an agent may incorrectly assume they are safe and execute unintended write or destructive operations without proper confirmation.

Static analysis

No suspicious patterns detected.