Security audit

yoooclaw-company-info-personal

Security checks across malware telemetry and agentic risk

Overview

This company lookup skill is mostly purpose-aligned, but it quietly stores and refreshes employee access tokens and uses broad triggers that could send company queries to a remote service unexpectedly.

Review before installing. Use this only if you trust the publisher and the configured company API, are comfortable sending employee identity and company queries to that service, and accept a persistent local token cache with silent refresh. Prefer HTTPS configuration and narrow triggers or confirmation for low-confidence company-name matches.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as a simple read-only company lookup tool, but it performs authentication lifecycle management, collects employee identifiers, and stores bearer tokens locally. This expands the trust boundary and creates credential-handling risk that users may not expect from a lookup skill, increasing the chance of token misuse or leakage.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documentation states the personal edition does not store data, but the code writes token and employee identity data to a filesystem cache that persists across runs. This is a security-relevant mismatch because users and reviewers may underestimate the persistence and sensitivity of the stored credentials.

Vague Triggers

High

Confidence: 92% confidence
Finding: The trigger phrases are extremely broad, including generic terms like '有限公司', '科技公司', and '公司信息', which can match ordinary conversation and invoke the skill unintentionally. In this skill, unintended invocation is more dangerous because it can silently send user queries to a remote API and may trigger backend collection/refresh behavior.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs silent token refresh and background handling of employee identity without user-facing warning. Hidden transmission of personal identifiers and credential refresh undermines informed consent and can expose employee data or reissue valid access tokens without clear visibility.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill tells users it will directly call a collection endpoint but does not clearly warn that company names are transmitted to a remote service and may cause server-side collection or refresh. This matters because broad triggers can cause accidental disclosure of queried entities and unexpected backend actions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:161