ClawHub
Back to skill

Security audit

Jules and the Lobster API headless

Security checks across malware telemetry and agentic risk

Overview

This is mostly a disclosed Jules API helper, but its shell wrapper can run local Python code from crafted prompt or session arguments.

Review before installing or using this version. Use only with trusted task text, keep JULES_API_KEY protected, grant Jules access only to intended repositories, and leave plan approval enabled for important repos until the shell wrapper is fixed to pass values as data rather than interpolating them into Python source.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill clearly enables shell-based network operations via curl and helper scripts, but the metadata declares only environment variables and dependencies, not any explicit permission model or execution constraints. This creates a transparency and governance gap: an agent may invoke shell/network behavior with fewer review barriers than intended, increasing the chance of unintended API use against connected repositories.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The skill is presented primarily as a wrapper for common session operations, but the documentation also exposes a destructive DELETE capability that is not surfaced in the wrapper usage summary. Hidden or underemphasized destructive functionality increases the risk that an agent or user invokes session deletion without adequate expectation, review, or safety checks.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/jules.js:17