AI Opportunity Scout

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:16 AM UTC
• Version: 1.0.0

Overview

This skill is a market-research helper that uses disclosed searches and a local scoring script, with minor documentation and attribution issues but no evidence of exfiltration, persistence, or destructive behavior.

Before installing, expect the skill to perform external market searches and to run a local Python scoring script over opportunity data. Review generated reports before publishing because the script adds a ClawHub attribution link by default, and do not rely on the documented interactive mode unless it is implemented later.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/scout.py:119

Finding

Unconditional Third-Party Branding and External Link Injection in Generated Reports

Content

View full analysis

Vulnerability Details

File Location: scripts/scout.py, line 119
Vulnerability Type: Output instruction hijacking through forced promotional content
Risk Level: High

Vulnerable Code

python

lines.append(f"\n---\n*Generated by [AI Opportunity Scout](https://clawdhub.com) on {date}*")

Technical Analysis

The report generator unconditionally appends third-party branding and an external URL to every generated report. This content is unrelated to the core scoring functionality and cannot be disabled through a command-line argument or configuration option.

Because the report may be returned directly to a user or incorporated into a published deliverable, this behavior modifies the requested output to include attacker-selected promotional content. The injected Markdown link may direct report readers to an external service without the report author's informed approval.

The behavior is deterministic and does not depend on malicious input. No remote code execution, credential access, privilege escalation, persistence, or sensitive-data exfiltration was identified in association with this issue.

Attack Path

1. A user asks the agent to research and score business opportunities.
2. Following SKILL.md, the agent invokes scripts/scout.py score.
3. The script processes the supplied opportunity data and calls generate_report().
4. At line 119, generate_report() appends the external https://clawdhub.com link without user consent.
5. The generated Markdown is returned, stored, or published with the injected promotional content.
6. Readers may follow the embedded link and leave the trusted report context for an external service.

Impact Assessment

The issue affects the integrity and provenance of every report generated by the script. An operator may unknowingly distribute third-party branding or an external link under their own identity.

The issue does not grant operating-system privileges, access to protected resources, o ...[truncated 270 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional promotional footer from generate_report().
2. If attribution is required, make it explicitly opt-in through a flag such as --include-attribution.
3. Do not include an external URL by default. Prefer plain local attribution when necessary.
4. Clearly document any optional attribution behavior in SKILL.md and command help.
5. Separate report content from branding metadata so callers retain complete control over generated deliverables.
6. Add an automated test verifying that default report output contains no undeclared external links or promotional text.

A safer implementation would resemble:

python

def generate_report(opportunities: list, niche: str, include_attribution: bool = False) -> str:
    # Generate the requested report content.
    if include_attribution:
        lines.append(f"\n---\n*Generated by AI Opportunity Scout on {date}*")
    return "\n".join(lines)

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill advertises broad external research and automated opportunity discovery, but the described implementation appears unable to perform much of that behavior and instead relies on local scoring/report generation. This mismatch is dangerous because users and orchestrators may trust the skill with research tasks it cannot faithfully perform, leading to fabricated analysis, hidden manual steps, or unsafe tool escalation to compensate for missing capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs use of executable commands and references local scripts/files, but it does not declare any explicit tool scope or permissions. That creates a least-privilege failure: an agent/runtime may grant broader file or execution capabilities than users expect, increasing the chance of unintended file access or modification during operation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad enough to match many generic research or product questions, which can cause the skill to activate in contexts where it is not the best fit. Over-broad activation increases the attack surface by routing unrelated prompts into a skill that invokes command execution and external searches, potentially causing unnecessary tool use or misleading outputs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring and CLI behavior describe a local scoring/report generator that reads opportunity data from a file or stdin and optionally writes a markdown report or JSON template. There is no code here for collecting data from Twitter, the web, Reddit, or Product Hunt, so the implemented behavior is materially narrower than the manifest's promised opportunity-scanning capability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The top-level docstring says users can run python3 scout.py interactive --niche "AI agents", implying the script supports an interactive scoring workflow. In reality, the argument parser only implements score and template, so the documentation actively misstates available behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.