ClawHub
Back to skill

Security audit

MachFive Cold Email

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward MachFive cold-email integration, but users should understand that it sends lead and sender information to MachFive and can spend account credits.

Before installing, store MACHFIVE_API_KEY as a secret, not in chat or source files. Only use lead data you are allowed to send to MachFive, review applicable email/privacy obligations, confirm credit costs before preview or generation, and use enrichment only when company, website, or LinkedIn data sharing is appropriate.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
95% confidence
Finding
The skill instructs users to configure and use a persistent third-party API key but does not include any warning about secure storage, least-privilege handling, or the risk of exposing the key in logs, prompts, or shared environments. In an agent setting, this omission matters because the key authorizes outbound requests to MachFive and could be misused if copied into insecure runtime configuration or surfaced to other tools.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill is explicitly designed to send lead data—including names, emails, titles, company details, and optionally LinkedIn URLs or websites—to a third-party service for generation and enrichment, yet it provides no user-facing privacy, consent, retention, or data-sharing warning. This is risky because agents may process personal or business-contact data automatically, and users may not realize that prospect data is being transmitted to an external vendor for AI processing and web research.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.