ClawHub
Back to skill

Security audit

go-intercom

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Go library guide for using Intercom's API, with disclosed token use and API mutation risks.

Install only if you intend to let a Go project call Intercom. Use a least-privilege Intercom token, choose the correct regional API host, and review any create, update, message, export, or delete operation before running it against a real workspace.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 8)May include surrounding context.

md
## Requirements

- Go 1.26.9 or newer, per the module's `go.mod`.
- An Intercom access token with the scopes needed for the requested operations, exported as `INTERCOM_ACCESS_TOKEN`.

## Install

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/setup.md (reported line 44)May include surrounding context.

md
| `IdentifyAdminWithResponse` | `GET /me` |
| `ListAdminsWithResponse` | `GET /admins` |
| `ListContactsWithResponse`, `CreateContactWithResponse` | `GET`, `POST /contacts` |
| `ShowContactWithResponse`, `UpdateContactWithResponse`, `DeleteContactWithResponse` | `GET`, `PUT`, `DELETE /contacts/{contact_id}` |
| `SearchContactsWithResponse` | `POST /contacts/search` |
| `ListAllCompaniesWithResponse` | `POST /companies/list` |
| `ListConversationsWithResponse`, `CreateConversationWithResponse` | `GET`, `POST /conversations` |

Static analysis

No suspicious patterns detected.