ClawHub
Back to skill

Security audit

Dynamic Content Personalizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed email-personalization helper that handles merge tags, fallbacks, segment rules, and PII checks without hidden execution or data transfer behavior.

Install only if you are comfortable giving the agent email creative, segment names, column lists, and aggregate fill-rate data. Avoid providing raw subscriber rows unless necessary, and review saved memory entries because the skill is designed to retain personalization specs and risk notes, while explicitly excluding raw PII from saved examples.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
| Stop and ask | Continue silently |
|---|---|
| No email creative provided, or no segment map / column list to personalize against — ask which base copy and which segments; do not fabricate segments or copy. | Which of several equally valid fallback strings to use (pick the safest neutral default and note it). |
| Fill-rates unknown AND the field drives a conditional offer — a low-fill field silently sending most subscribers to the wrong branch is a real risk; ask for the fill-rate or default the whole segment to the catch-all. | A field is missing for a *cosmetic* tag only (e.g. first name) — proceed with a fallback and note it, no need to stop. |

**Scope guard**: this skill wires the personalization layer onto **existing** copy and **existing** segments. It does **not** build or name segments — that is [list-segment-builder](../../setup/list-segment-builder/SKILL.md); it does **not** write the subject/body/CTA — that is [email-creative-builder](../email-creative-builder/SKILL.md); and it does **not** score any SEND dimension, compute the EQS, or run the S1/S2/N1/D1 vetoes — that is [email-quality-auditor](../../deliver/email-quality-auditor/SKILL.md) alone.

Static analysis

No suspicious patterns detected.