ClawHub
Back to skill

Security audit

List Segment Builder

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an email list segmentation helper, but it includes an optional live command that can change contact suppression status in Resend.

Install only if you are comfortable with an agent seeing email-list exports and consent/suppression facts. Treat any Resend sync as a separate, explicit action: keep dry-run mode unless you intentionally approve live suppression changes, and verify the affected contacts before using `--live`.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill is documented as a segmentation and suppression-list builder, but it also advertises a live mutation path to push suppressions into Resend with `--live`. That expands the trust boundary from local analysis into external state-changing operations, creating a capability mismatch that could let an agent alter production email platform state when the user only intended analysis or planning.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
Exposing `resend.py suppress <id-or-email> --live` gives the skill direct platform-write authority unrelated to its primary purpose of deriving segments from exports. In an agent environment, unnecessary write primitives increase the chance of accidental or prompt-induced suppression of real contacts, causing operational impact and violating least-privilege expectations.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The documentation contains an internal contradiction: it repeatedly states the skill only reads consent data and only defines who is suppressed, yet it also describes a live suppression action against Resend. That inconsistency can mislead operators and agents about the skill’s true authority, making unsafe state changes more likely under the assumption that the skill is read-only.

Static analysis

No suspicious patterns detected.