ClawHub
Back to skill

Security audit

drivethru-digitize-outsourcing

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-built for outsourcing digitizing jobs, but it can submit customer artwork to an outside vendor and change Odoo records with broad MCP access and limited user confirmation.

Review this before installing if the Odoo MCP token can reach production or broad ERP tools. Install only in an environment where the MCP endpoint is limited to the intended digitizing tools, and require operator review before confirmed vendor submission or Odoo state changes unless that automation is explicitly acceptable. Treat downloaded artwork as sensitive customer data and clean it up after use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The skill claims to implement a narrowly scoped outsourcing routine, but the content actually grants a generic pattern for listing all Odoo MCP tools and calling any tool with arbitrary JSON. That mismatch is dangerous because it enables broader ERP access than users would reasonably expect, increasing the risk of unauthorized reads, writes, or destructive operations under the guise of a routine business workflow.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares access to environment variables and an MCP-backed operational workflow, but does not constrain tool scope with explicit permissions or allowed-tools. In practice, this makes it easier for an agent to invoke unintended capabilities in a sensitive ERP context, especially because the skill text itself encourages generic tool discovery and use against Odoo.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The invocation text uses broad trigger phrases like outsourcing digitizing or sending jobs to the digitizer, which can match ordinary business requests without making the side effects explicit. Because this skill can download files, submit external jobs, and update Odoo state, overbroad triggering raises the chance of accidental activation and unintended transactional actions.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
explicitly approves — e.g. they re-run you scoped to those specific demand ids,
or tell you to include them. (This gate is temporary and will be removed later.)

Non-rush, `outsource_ready` demands proceed without approval.

### 4. Build the brief
Confidence
90% confidence
Finding
The skill explicitly authorizes autonomous action for non-rush demands without human approval, including external submission to a third-party digitizer and mutation of ERP records. In a business system, this is risky because misclassification, bad data, or prompt-triggered execution can cause unauthorized outsourcing, data disclosure to a vendor, and incorrect operational state changes.

Missing User Warnings

Low
Confidence
81% confidence
Finding
The routine explicitly instructs the agent to download customer artwork from CDN URLs and write the files to local disk, but it provides no guidance on secure handling, storage location, cleanup, or access controls for those potentially sensitive files. Even though this is part of the business workflow, local persistence of artwork increases exposure risk through leftover files, insecure temp directories, backups, logs, or multi-tenant host access.

Static analysis

No suspicious patterns detected.