ClawHub
Back to skill

Security audit

drivethru-production-scheduler

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Odoo production scheduler, but it gives an agent broad live Odoo MCP access that can read and change operational records beyond a tightly enforced scheduling boundary.

Install only if the Odoo MCP token is scoped to scheduling-specific read/write tools and records, and make sure users understand that confirmed writes can reorder production batches and change machine/time assignments. Prefer adding a local allowlist for the listed production tools and keeping generic model reads read-only and limited to manufacturing records.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill declares access to sensitive environment variables and an MCP-backed execution capability, but does not expose an explicit permission boundary describing what remote actions it may take. In practice, it can authenticate to a live Odoo endpoint and perform scheduling writes, so the missing permission declaration weakens reviewability and increases the risk of over-privileged use or unintended data modification.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill presents itself as a production scheduler, but its instructions explicitly tell the agent to enumerate all MCP tools and invoke any tool name with arbitrary JSON, effectively turning it into a general-purpose authenticated Odoo MCP client. That mismatch is dangerous because a user or prompt injection could steer the agent into unrelated high-impact actions on the remote system under the cover of a narrowly described skill.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The invocation language is broad enough to trigger on many common planning or scheduling requests, which can cause the skill to activate in contexts where live Odoo reads or writes were not intended. Because this skill can reorder production batches and update schedules, over-triggering raises the chance of accidental operational changes from ambiguous user prompts.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The `call` subcommand accepts an arbitrary tool name and arbitrary JSON arguments, then forwards them directly to the remote Odoo MCP server using a bearer token with no local allowlist, policy checks, or confirmation step. In the context of a production scheduler skill that is explicitly designed to read and modify manufacturing state, this creates a real capability-exposure issue: anyone able to invoke this script can trigger any MCP-exposed operation the token permits, including potentially sensitive reads or state-changing writes beyond intended scheduling actions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.