ClawHub
Back to skill

Security audit

Spaces by Peakflo

Security checks for vulnerabilities and agentic risk

Overview

The verdict is benign because the reported external connection and task handoff fit the skill’s stated purpose, though the scanners flag a mismatch between its declared scope and some permitted actions.

Before installing, consider whether you need a skill that can do more than hand off tasks and query workspace resources, including actions that may change data or resume workflows with financial effects. The scanner analysis is incomplete: a local reference was unresolved and the binary icon was outside its analysis scope, so the verdict does not establish that every artifact detail was inspected.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
only, destructive or open-world. Treat anything not read-only as a write.
- **Don't start payments, and don't hide indirect ones.** You must not transfer money, make a payment or trade securities on your own. When asked to ("pay vendor X now", "buy 100 shares"), say you can't, and offer to create a task for a person instead. Spaces actions *can* lead to real money movement, though. Completing an approval can resume a workflow that posts entries or releases a payment. A workflow or a connected accounting, ERP or banking app can create or release payments. Before any of these, tell the user plainly that it may move money, and get an explicit yes. Afterwards, report exactly what the tool returned. Never say that no money moved, or that a payment happened, unless the result says so.
- Report results exactly as the tools return them, including failures.
- To disconnect, the user can run `openclaw mcp logout peakflo`, or revoke access in app.peakflo.ai → **Settings → MCP → Connected apps**.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
Server facts:

- URL: `https://api.peakflo.ai/mcp`
- Transport: Streamable HTTP. Set it explicitly; OpenClaw uses SSE when `transport` is omitted.
- Auth: OAuth 2.1 with PKCE (S256) and dynamic client registration. The user signs up or signs in in the browser. There are no API keys or tokens to paste.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

bash
openclaw mcp add peakflo \
  --url https://api.peakflo.ai/mcp \
  --transport streamable-http \
  --auth oauth

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
mcp: {
    servers: {
      peakflo: {
        url: "https://api.peakflo.ai/mcp",
        transport: "streamable-http",
        auth: "oauth"
      }

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
- `doctor --probe` should report the server as ok and list its tools. A warning such as "OAuth credentials are not authorized" means the login step has not finished yet.
- OpenClaw exposes the tools as `peakflo__<tool>`. In this skill, a bare tool name refers to that tool: `task_create` means `peakflo__task_create`, `workflow_execute` means `peakflo__workflow_execute`, and so on. The safety rules below apply to the prefixed names too.

Never ask the user for a password, API key, token or authorization code in chat. Sign-in always happens in the browser.

## Hand off work: `task_create`

The skill permits direct workspace mutations beyond the manifest's task-handoff and query scope.

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The manifest at L003 describes handing off tasks and querying workspace resources. L108 additionally authorizes workflow execution, approval completion, connected-app writes, and modification or deletion of table data after confirmation; L110 acknowledges that some of these operations can release payments. Confirmation reduces risk but does not make these direct mutations part of the declared handoff-and-query scope.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
e`), call a connected-app tool that changes data (`integration_mcp_tool_call`), or change or delete table data, show the user exactly what you will do and wait for a yes.
- Every Spaces tool is annotated read-only, destructive or open-world. Treat anything not read-only as a write.
- **Don't start payments, and don't hide indirect ones.** You must not transfer money, make a payment or trade securities on your own. When asked to ("pay vendor X now", "buy 100 shares"), say you can't, and offer to create a task for a person instead. Spaces actions *can* lead to real money movement, though. Completing an approval can resume a workflow that posts entries or releases a payment. A workflow or a connected accounting, ERP or banking app can create or release payments. Before any of these, tell the user plainly that it may move money, and get an explicit yes. Afterwards, report exactly what the tool returned. Never say that no money moved, or that a payment happened, unless the result says so.
-