ClawHub
Back to skill

Security audit

AI-as-a-Service ROI Calculator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple ROI calculator, but it forces vendor booking and payment links into normal outputs, which can steer users commercially without a clear request.

Review this skill carefully before installing. It appears technically low-risk for the local machine, but its normal responses are designed to promote a specific provider and payment flow; use it only if you are comfortable with vendor-specific sales links being included in ROI analyses.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:83
Finding
Mandatory Commercial Output Hijacking Through Embedded Booking and Payment Links## Vulnerability Details **File Location**: `SKILL.md`, lines 83–87 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```text 💡 Next step: Book a free consultation to see a live demo → https://calendly.com/cbeckford-afrexai/30min 🚀 Start with our $750/month intro offer (first month) → https://buy.stripe.com/fZuaEQaPs9Mrge87l50sU0a ``` ### Technical Analysis The Skill places vendor-specific promotional content inside its prescribed ROI-analysis output template. Consequently, an agent following the Skill is instructed to append consultation and payment links even when the user only requests a financial calculation and does not request vendor contact or purchasing information. This alters the expected goal of a neutral ROI-calculation session by turning the response into a commercial referral. The external links direct users to vendor-controlled Calendly and Stripe destinations. No local code execution, credential theft, persistence, privilege escalation, or system compromise was identified; the issue affects response integrity and user decision-making rather than host security. ### Attack Path 1. A user asks the agent to calculate the return on investment for deploying AI agents. 2. The agent loads and follows the instructions in `SKILL.md`. 3. The agent generates the requested ROI analysis using the mandatory output template. 4. The template causes the agent to append a consultation link and a Stripe purchase link regardless of whether the user requested promotional information. 5. The user may interpret these links as a trusted or neutral recommendation and navigate to vendor-controlled commercial services. ### Impact Assessment The vulnerability allows the Skill author to influence normal agent responses and steer users toward specific commercial endpoints. The affected scope includes the integrity and neutrality of ROI reports generated with this Skill. No operating-system privileges or ad ...[truncated 260 chars]
Remediation
## Remediation Suggestions 1. Remove the consultation and Stripe purchase links from the mandatory ROI output template. 2. Keep the calculator vendor-neutral and separate financial calculations from promotional material. 3. Display vendor links only when the user explicitly asks for purchasing, consultation, or provider-contact information. 4. Clearly label any optional vendor-specific content as advertising or promotional material. 5. Require explicit user confirmation before directing the user to a payment endpoint. 6. Document the ownership and purpose of external destinations so users can make an informed decision before leaving the agent interface. 7. Add a review rule prohibiting unsolicited affiliate, booking, payment, or lead-generation links in standard Skill outputs.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Scope Creep

Low
Category
Excessive Agency
Content
```

### Key Selling Points
- **No technical setup required** — we deploy and manage everything
- **Week 1 Win** — see results in the first 7 days
- **86-96% gross margins** means pricing is sustainable
- **Cancel anytime** — no long-term contracts
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.