ClawHub
Back to skill

Security audit

Cold Email Writer

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only cold-email writing skill with no executable code, hidden actions, credential access, or persistence, though users should review generated outreach and be cautious about optional external installs.

Before installing, understand that this skill helps draft sales outreach; verify personalization claims and compliance before using any email. Treat the listed optional installs and external context-pack links as separate, unaudited items and inspect them independently before installing or buying them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:74
Finding
Unpinned Third-Party Package Installation Recommendations## Vulnerability Details **File Location**: `SKILL.md`, lines 74-94 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Low The skill recommends installing numerous unrelated third-party packages through mutable package names. It provides no version constraints, integrity hashes, package provenance, or verification instructions. ```markdown ## 🔗 More AfrexAI Skills (Free on ClawHub) | Skill | Install | |-------|---------| | AI Humanizer | `clawhub install afrexai-humanizer` | | SEO Writer | `clawhub install afrexai-seo-writer` | | Email Crafter | `clawhub install afrexai-email-crafter` | | Proposal Generator | `clawhub install afrexai-proposal-gen` | | Invoice Generator | `clawhub install afrexai-invoice-gen` | | Lead Scorer | `clawhub install afrexai-lead-scorer` | | Client Onboarding | `clawhub install afrexai-onboarding` | | Meeting Prep | `clawhub install afrexai-meeting-prep` | | Social Repurposer | `clawhub install afrexai-social-repurposer` | | FAQ Builder | `clawhub install afrexai-faq-builder` | | Review Responder | `clawhub install afrexai-review-responder` | | Report Builder | `clawhub install afrexai-report-builder` | | CRM Updater | `clawhub install afrexai-crm-updater` | | Pitch Deck Reviewer | `clawhub install afrexai-pitch-deck-reviewer` | | Contract Analyzer | `clawhub install afrexai-contract-analyzer` | | Pricing Optimizer | `clawhub install afrexai-pricing-optimizer` | | Testimonial Collector | `clawhub install afrexai-testimonial-collector` | | Competitor Monitor | `clawhub install afrexai-competitor-monitor` | ``` ### Technical Analysis The listed packages are not required for the documented cold-email-writing functionality. Recommending installation by an unversioned registry identifier makes the resolved content dependent on the registry state at installation time rather than the content reviewed in this project. If a recommended package or its publisher a ...[truncated 1701 chars]
Remediation
## Remediation Suggestions 1. Remove unrelated package-installation promotions from the skill definition so that its trust boundary remains limited to cold-email generation. 2. If the recommendations are retained, pin each package to an audited immutable version rather than resolving a mutable package name. 3. Publish expected checksums, signatures, source repositories, and publisher identity information where supported. 4. Instruct users to verify package provenance and inspect requested permissions before installation. 5. Separate optional integrations from the core skill documentation and clearly state that they are independently maintained and were not reviewed as part of this package. 6. Use a dependency lock or verified manifest if these packages ever become functional dependencies. 7. Periodically reassess recommended packages for ownership changes, compromise notices, and unexpected updates.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The usage instruction is very broad: 'Tell your agent who you're emailing, what you sell, and what problem you solve for them. It handles the rest.' This leaves trigger conditions and operational boundaries undefined, which can cause the agent to invoke the skill in unintended contexts, generate outreach without sufficient review, or act on incomplete inputs. In a messaging/generation skill, ambiguous invocation scope increases the chance of misuse, overreach, or unsafe automation.

Static analysis

No suspicious patterns detected.