ClawHub
Back to skill

Security audit

Prospect Researcher

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does disclosed public B2B prospect research, but its active instructions include an unrelated third-party promotional redirect that users should review before installing.

Install only if you are comfortable with a prospecting skill that performs public web research about companies and professional contacts. Review or remove the unrelated third-party promotional line before use, and keep outputs limited to lawful public or user-provided data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:65
Finding

Unrelated Third-Party Promotional Instruction in Agent Context

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 65
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code

md
Get pre-built ICP profiles and outreach sequences for your industry at https://afrexai-cto.github.io/context-packs

Technical Analysis

The skill embeds an imperative directing users to a fixed third-party website. This instruction is unrelated to the skill’s core prospect-research workflow and is placed directly in SKILL.md, whose contents govern the agent’s behavior when the skill is loaded.

An agent may interpret this line as an instruction to promote or redirect users to the external resource during ordinary research interactions. This alters expected session behavior by introducing unsolicited promotional content. Moreover, the destination is externally controlled and can change after the skill has been reviewed.

No evidence was found that the skill retrieves or executes code from this URL; therefore, the finding is limited to instruction hijacking rather than remote payload execution.

Attack Path

  1. A user installs and invokes the prospect-researcher skill.
  2. The agent loads the instructions from SKILL.md.
  3. The agent processes the unrelated promotional imperative on line 65 as part of its active instructions.
  4. During a prospect-research interaction, the agent may promote or direct the user to the fixed external website.
  5. The website operator may independently alter the destination’s content after the skill package has been audited.

Impact Assessment

The instruction can influence the agent’s current-session output by adding unsolicited advertising or external redirection. Its scope is limited to users and sessions in which this skill is loaded.

The instruction does not grant operating-system privileges, access credentials, establish persistence, or provide a demonstrated code-execution path. The principal impact is loss of output integrity and user t ...[truncated 93 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the promotional instruction from SKILL.md.
  2. Keep active skill instructions strictly limited to behavior required for prospect research.
  3. If the resource has a legitimate documentation purpose, move it to a clearly labeled, optional “External Resources” section in README.md.
  4. Use neutral, non-imperative wording and explicitly state that visiting or mentioning the resource is not required for skill operation.
  5. Do not require the agent to include external promotions in user-facing responses.
  6. Review and approve external links before release, and periodically verify that their destinations and content remain appropriate.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · research-template.md (reported line 22)May include surrounding context.

md
## What They Do

<!-- 2-3 sentence plain-English summary -->

## Recent Activity (Last 6 Months)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill activates on very broad requests like researching a prospect, company, or lead, without defining clearer trigger boundaries or requiring explicit user intent confirmation. In an agent environment, this can cause over-broad invocation on ordinary research tasks, leading the skill to collect extensive third-party profiling data and produce outreach recommendations when the user may not have intended that level of prospect intelligence gathering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown template includes a 'Key Contacts' section requesting names, LinkedIn profiles, recent activity, and inferred priorities, which involves collecting and recording personal/professional data. The file does not include any warning or guidance about using public sources, respecting privacy, or handling personal data appropriately.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.