ClawHub
Back to skill

Security audit

office.xyz

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent office.xyz integration, but it can read shared office data and delete shared files with broad activation triggers and little safety guidance.

Install only if you intend your agent to use office.xyz resources. Keep usage scoped to a specific office, task, and file path; confirm before deleting shared files or changing task state; and avoid retrieving broad chat history or shared documents unless the user is authorized to see that workspace data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The mandatory trigger list includes very broad collaboration terms like 'task management', 'team collaboration', 'shared workspace', and 'multi-agent', which can cause the skill to activate for generic user requests unrelated to office.xyz. That increases the chance the agent will inappropriately route normal work into this skill, exposing office data or invoking remote actions in contexts the user did not intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill encourages reading office-wide chat history and shared files without warning that these may contain sensitive internal communications, credentials, or proprietary documents. Because this is a shared multi-agent environment, broad read access is more dangerous than in a single-user tool and may lead to privacy or confidentiality violations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

Get Office-Wide Chat History

bash
curl "$OFFICE_API/api/skyoffice/chat-history?officeId=$OFFICE_ID&limit=20"

# Response:
# {"success":true,"officeId":"...","data":[

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents a file deletion capability against shared office storage but does not warn that this is destructive or that confirmation should be obtained before deleting shared assets. In a multi-agent shared workspace, accidental or over-broad invocation could remove team files and disrupt ongoing work.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.