ClawHub
Back to skill

Security audit

Lead Enrichment

Security checks for vulnerabilities and agentic risk

Overview

This lead-enrichment skill is purpose-aligned in concept, but it ships misleading mock enrichment output and unsafe shell scripts that require review before installation.

Review or fix the scripts before installing. Do not process untrusted CSV files with batch.sh, do not rely on the produced dossiers as real research, avoid shared secrets-file probing, and consider privacy, retention, and CRM-transfer obligations before using this for prospect or candidate data.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/batch.sh:69
Finding

Arbitrary Command Execution Through Crafted Batch CSV Records

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/batch.sh:54
Finding

Output Directory Escape Through Unsanitized Lead-Derived Filenames

Content
View full analysis
Processing: $name, $company" "$script_path" --name "$name" --company "$company" --output "$output_filename" > /dev/null ``` The resulting path is written by `scripts/enrich.sh`, lines 154–155: ```bash if [[ -n "$OUTPUT_FILE" ]]; then echo "$RESULT_JSON" > "$OUTPUT_FILE" ``` ### Technical Analysis The filename “sanitization” only lowercases input and replaces repeated spaces with hyphens. It does not remove or reject: - Forward slashes. - `..` parent-directory components. - Absolute-path-related syntax. - Control characters. - Dot-prefixed path components. - Other characters unsuitable for generated filenames. Consequently, attacker-controlled name or company fields can introduce path separators and traversal components into `output_filename`. Shell quoting prevents argument splitting, but it does not prevent the operating system from resolving `../` components. The `>` operator in `enrich.sh` creates or truncates the resolved destination. There is no canonical-path containment check and no confirmation before overwriting an existing file. ### Attack Path 1. An attacker supplies a batch CSV containing traversal components in a name or company field. 2. `batch.sh` extracts the field using `cut` and removes only double-quote characters. 3. The slug transformation preserves `/` and `..`. 4. The resulting path is appended to the requested output directory. 5. Path resolution escapes the intended output directory. 6. `enrich.sh` redirects generated JSON to the escaped path. 7. If the destination exists a ...[truncated 1191 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill advertises extensive enrichment, scraping-adjacent collection, batch processing, export, caching, and talking-point generation that are not actually implemented in the described artifacts. This mismatch can mislead operators into granting broader privileges, trusting outputs that were never produced, or integrating the skill into sensitive workflows under false assumptions about behavior and safeguards.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md
},

    "premium_sources": {
      "_note": "Optional paid services — add API keys to ~/.clawdbot/secrets.env",
      "hunter_io": {
        "enabled": false,
        "api_key_env": "HUNTER_API_KEY",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.example.json (reported line 53)May include surrounding context.

json
},

    "premium_sources": {
      "_note": "Optional paid services — add API keys to ~/.clawdbot/secrets.env",
      "hunter_io": {
        "enabled": false,
        "api_key_env": "HUNTER_API_KEY",

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The script accesses a shared secrets file under $HOME/.clawdbot/secrets.env during setup, which constitutes credential discovery behavior. In the context of a lead-enrichment skill that aggregates external data sources, probing for available commercial API credentials increases risk because it expands visibility into the user's broader secret inventory without explicit consent.

Content

Scanner excerpt · scripts/setup.sh (reported line 41)May include surrounding context.

sh
# Check for optional premium source API keys
PREMIUM_SOURCES_FOUND=false
if [ -f "$HOME/.clawdbot/secrets.env" ]; then
  if grep -q "HUNTER_API_KEY" "$HOME/.clawdbot/secrets.env" 2>/dev/null; then
    echo "  ✓ Hunter.io API key found"
    PREMIUM_SOURCES_FOUND=true

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

This grep checks whether HUNTER_API_KEY exists in a global secrets file, revealing the presence of a credential unrelated to minimal setup needs. Even without exfiltrating the value, enumerating available secrets can aid later misuse or normalize unauthorized inspection of sensitive files.

Content

Scanner excerpt · scripts/setup.sh (reported line 42)May include surrounding context.

sh
# Check for optional premium source API keys
PREMIUM_SOURCES_FOUND=false
if [ -f "$HOME/.clawdbot/secrets.env" ]; then
  if grep -q "HUNTER_API_KEY" "$HOME/.clawdbot/secrets.env" 2>/dev/null; then
    echo "  ✓ Hunter.io API key found"
    PREMIUM_SOURCES_FOUND=true
  fi

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

This check enumerates the presence of CLEARBIT_API_KEY in a shared secrets file, which is unnecessary for safe setup and exposes metadata about the user's secret holdings. Credential-presence discovery is sensitive because it can be combined with social engineering, follow-on code changes, or user profiling.

Content

Scanner excerpt · scripts/setup.sh (reported line 46)May include surrounding context.

sh
echo "  ✓ Hunter.io API key found"
    PREMIUM_SOURCES_FOUND=true
  fi
  if grep -q "CLEARBIT_API_KEY" "$HOME/.clawdbot/secrets.env" 2>/dev/null; then
    echo "  ✓ Clearbit API key found"
    PREMIUM_SOURCES_FOUND=true
  fi

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

This line probes for APOLLO_API_KEY in a global secrets file, continuing the same pattern of unauthorized secret inventorying. The skill context makes this more concerning because sales-intelligence tooling naturally benefits from premium data sources, creating incentive to opportunistically discover and use existing credentials.

Content

Scanner excerpt · scripts/setup.sh (reported line 50)May include surrounding context.

sh
echo "  ✓ Clearbit API key found"
    PREMIUM_SOURCES_FOUND=true
  fi
    if grep -q "APOLLO_API_KEY" "$HOME/.clawdbot/secrets.env" 2>/dev/null; then
    echo "  ✓ Apollo API key found"
    PREMIUM_SOURCES_FOUND=true
  fi

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill explicitly instructs users to run shell scripts (setup.sh, enrich.sh, batch.sh, export.sh) but does not declare an allowed tool scope or permissions boundary. In an agent environment, this creates ambiguity about what command execution is expected and can lead to overbroad shell access, making misuse or accidental execution of unsafe commands more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is designed to collect, infer, store, and package personal and contact data about third parties, including likely email addresses, social profiles, recent activity, and talking points, but it does not prominently warn users about the privacy and compliance implications. In this context, the omission is significant because the skill encourages dossier-building and outreach workflows that can easily cross legal, policy, or ethical boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill directly promotes piping enriched lead records into a CRM via HTTP POST without an explicit warning that this transmits third-party personal data to an external system. Because the exported data may include inferred emails, social profiles, activity, and company intelligence, silent onward transfer increases privacy, compliance, and data-governance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The example command sends enriched lead data to an external endpoint with curl, which constitutes outbound transmission of potentially sensitive personal data. While CRM export is a legitimate use case, the context makes this dangerous because users may copy-paste the pattern without understanding that dossier contents are being exfiltrated from the local environment to a third-party service.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

Pipe to your CRM

./scripts/export.sh --format json enriched/*.json |
curl -X POST https://your-crm.com/api/leads -d @-

text

## Config

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This section enables contact discovery, including pattern-based email guessing and MX verification, which materially increases the privacy sensitivity of the skill. In a lead-enrichment and outreach context, this can facilitate profiling and contact inference about individuals without explicit notice or consent, making misuse for unsolicited outreach or bulk targeting more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The config enables saving enriched lead dossiers to disk by default, including contact info, social profiles, recent activity, and raw sources, without any explicit warning or stronger safeguards. In this skill's context, the stored data is potentially sensitive personal and business intelligence, so default local persistence increases risk of unintended retention, local compromise, or secondary misuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata promises real multi-source enrichment, but the implementation explicitly returns fabricated mock data. In a lead-enrichment context, this can mislead downstream automation, sales decisions, CRM records, and user trust because the output looks authoritative despite not being sourced from real external systems.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script accepts LinkedIn input and the skill description advertises LinkedIn-based enrichment, but no LinkedIn parsing or enrichment is performed. In this context, unsupported inputs can cause silent misoperation or misleading outputs, especially when users rely on the tool for automated prospect research.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 32)May include surrounding context.

sh
if ! command -v "$tool" &> /dev/null; then
    echo "⚠ Prerequisite missing: '$tool'. Please install it to continue."
    # On macOS: brew install jq
    # On Debian/Ubuntu: sudo apt-get install jq
    exit 1
  fi
done

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The setup script reads an unrelated global secrets file in the user's home directory to detect third-party API keys. Even though it only checks for key names and does not print secret values, this is still credential discovery against a broader secret store outside the skill's own configuration boundary, which violates least privilege and normal user expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
23% confidence
Finding

This section constrains output style options, including one described for cold outreach, but it does not require a specific human language or locale. Because SQP-3 is limited to language/locale policy violations, this does not clearly meet the rule and is low confidence.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This JSON manifest includes natural-language notes describing automatic behaviors such as 'Auto-enrich leads that reach QUALIFIED state' and 'POST enriched leads to your CRM after processing' without clarifying the exact triggering conditions, exclusions, or user control boundaries. In a manifest/config context, this can make invocation scope ambiguous and increase the risk of unintended automatic execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script exposes flags for talking points, depth, and refresh, but these options do not influence output. While not a direct code-execution flaw, this is still security-relevant deception in an automation skill because operators may assume controls like refresh or output depth are functioning when they are not.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The script performs a file write when --output is provided, but there is no prior warning in comments or usage text that running the skill can overwrite a local file path. Under the code-file criteria, file writes should have some form of user disclosure unless clearly covered by the skill description; here the write behavior is only implicit in the flag name and success message after the fact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.