ClawHub
Back to skill

Security audit

Ironclaw Lead Enrichment

Security checks for vulnerabilities and agentic risk

Overview

This skill is for lead enrichment, but it can bulk infer personal email addresses and write them into CRM records without clear consent, verification, or confirmation controls.

Review before installing if your workspace contains real lead or customer data. Use this only where you have a lawful basis and authorization to enrich contacts, require confirmation before bulk runs, label inferred emails as unverified, and avoid automatically writing guessed addresses into CRM records without review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill explicitly instructs the agent to derive missing email addresses from company domains, common naming patterns, search results, and team pages, but provides no safeguards around consent, legality, accuracy, or user notification. This is dangerous because it enables bulk inference of personal contact information that may be incorrect or privacy-invasive, creating risks of misdirected outreach, processing of personal data without authorization, and misuse at scale.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The manifest description contains broad trigger phrases such as "fill in missing data," "look up company info," and "any bulk data completion task," which can cause the agent to invoke this skill for a wide range of CRM requests beyond narrowly scoped lead enrichment. In this context, overbroad routing is risky because the skill performs external lookups and inferred contact-data generation, so unintended invocation could expose personal data to unnecessary processing or trigger privacy-sensitive enrichment without clear user intent.

Static analysis

No suspicious patterns detected.