T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:40- Finding
Hard-Coded Supabase API Credential
- Content
View full analysis
- Remediation
View remediation
Security audit
Contractor Marketing Cowork Plugin
Security checks for vulnerabilities and agentic risk
Overview
This contractor marketing skill is purpose-aligned, but it needs Review because it can automate live business-account actions and persist sensitive business/customer data without enough scoping and consent safeguards.
Install only if you are comfortable supervising it closely. Review every public post, review reply, campaign, email sequence, CSV import, and scheduled task before it touches a live account; avoid sharing unnecessary customer or employee details; keep `business-profile.md` out of source control and shared folders; and prefer a pinned installer version.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
README.md:47- Finding
Unpinned Remote Package Execution During Installation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
commands/onboard.md:10- Finding
Sensitive Business Profile Persisted in a Predictable Plaintext File
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (26)
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: contractor-marketing-cowork description: "Cowork Plugin: AI marketing department for contractors and home service businesses. 12 slash commands + 6 background skills for SEO, ads, social media, proposals, job costing, competitor audits, and more. Works with Claude Cowork, Claude Code, and OpenClaw. Includes 74 proven strategies from Heavy Metric. Use when the user needs marketing help for a local service business." --- # Contractor Marketing — Cowork Plugin AI marketing department for contractors and home service businesses. Built by a contractor, not an agency. ## Commands | Command | What it does | |---------|---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file advertises broad browser automation and automatic querying across advertising, CRM, analytics, directory, and social platforms, including systems likely to contain customer records, business performance data, and account credentials, but it provides no disclosure, scoping limits, or consent boundaries. In this skill context, the risk is elevated because a marketing agent for contractors is likely to access sensitive business and customer information across many third-party services, making unintended data exposure or over-collection plausible.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README advertises commands that generate and publish Google Business Profile posts and schedule social content, but it does not clearly warn that these actions may affect live external accounts. In a plugin that automates marketing for business users, this omission increases the chance of accidental publishing, brand damage, or unintended use of connected services.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 83% confidence
- Finding
The README tells users to run
npx clawhub@latest install contractor-marketing, which fetches and executes the latest package version at install time rather than a pinned, reviewed release. If the upstream package is compromised or a breaking/malicious release is published, users could execute unintended code during installation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README instructs users to create recurring scheduled tasks for content generation and review actions without warning about repeated execution against connected services. In this skill's context, recurring automated runs could repeatedly post content, alter business-facing outputs, or create noisy/unwanted actions across external platforms if misconfigured.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description is broadly phrased to trigger whenever a user 'needs marketing help for a local service business,' which can cause the skill to activate in situations the user did not explicitly request. Because the skill includes external integrations and automated actions, overbroad routing increases the chance of unintended account-affecting behavior or unnecessary exposure of business data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file states that background skills are 'Loaded automatically' and used 'when relevant' without defining relevance boundaries, approval requirements, or data-sharing limits. In an agent environment, this can lead to hidden prompt/tool chaining, where additional capabilities are invoked without clear user awareness, potentially broadening access to sensitive business information or enabling unexpected actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises direct integrations and browser automation for Google Business Profile, ad platforms, email tools, analytics, and operational systems, but it does not warn that these may modify external accounts or publish content. In this context, silent or poorly understood account-affecting capabilities are dangerous because users may trigger actions that spend money, change campaigns, post publicly, or expose customer and business data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The command uses broad natural-language triggers like "set it up" or "create the campaign" to initiate browser-based ad campaign setup. These phrases can appear in ordinary conversation or be injected indirectly through prior context, causing the agent to begin sensitive external actions without an explicit, scoped confirmation that the user intends account-affecting automation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to query an external MCP source and optionally pull Search Console data via computer use, but it does not require explicit user consent, disclose what data may be transmitted, or impose data-minimization boundaries. In a marketing workflow, this can expose sensitive business information such as keyword performance, customer-derived questions, and operational details to external systems without the user clearly understanding or approving the access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to import a customer CSV into Mailchimp or MailerLite through computer use without any explicit requirement to warn the user, confirm consent, minimize data fields, or verify that sharing customer information with a third-party platform is authorized. This creates a real privacy and compliance risk because the agent could transmit personally identifiable customer data to an external service in a way the user did not fully understand or approve.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes steps to publish directly to a live Google Business Profile and only asks the user whether to post after generating content, without an explicit upfront warning that this performs a public, externally visible account action. This creates a real risk of unintended publication, especially in an agent/computer-use context where users may not fully appreciate that the action affects a production business profile immediately.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
For a markdown skill file, vague trigger language is in scope. The phrase "Or provides in any format. Parse and calculate." lacks boundaries or negative examples, so ordinary business text about jobs or costs could be interpreted as an activation condition for this skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill operationalizes SMS, email, and call follow-up templates for CRM/Twilio use while omitting any checks for consent, opt-in status, privacy handling, or applicable telemarketing rules. Because it is designed for rapid outreach to new leads, this context makes the omission more dangerous: users may copy automated sequences directly into live systems and contact individuals without lawful basis or adequate data protections.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrase is broad enough that an agent could activate the workflow from loosely formatted user input and generate outreach content using incomplete or unintended lead data. In a sales automation context, ambiguous triggering increases the chance of misfires, accidental processing of personal information, and preparation of unsolicited follow-up messages.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This onboarding command collects a large amount of sensitive business and personal information, including employee names, addresses, phone numbers, emails, licensing details, software stack, and payment methods, then instructs storing it in a local markdown file without any privacy notice, minimization, or sensitivity warning. In an agent/tooling environment, persistent plaintext storage increases the chance of unintended exposure through later commands, workspace sharing, backups, logs, or source control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill contains instructions to navigate to Google Business and submit replies directly, but it does not require an explicit warning that the action will make irreversible public posts on an external service. This increases the chance of accidental publication of unreviewed, inaccurate, or legally risky responses, especially for negative reviews where wording can have reputational or liability consequences.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger condition "If user says 'post them'" is too generic for a skill that can perform live browser actions and submit public responses. In normal conversation, a user may say similar wording while discussing options rather than authorizing publication, which can cause unintended external posting under the computer-use flow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The command explicitly encourages accessing Google Search Console, Google Analytics, Meta Ads, and Google Ads data via computer use, but provides no guardrails about consent, account scope, sensitive business data exposure, or safe handling of exported CSVs. Because these platforms contain proprietary performance, customer acquisition, and spend data, an agent could over-collect or expose confidential information during automated access or reporting.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description says the skill activates when discussing "ads, campaigns, CPL, ROAS, Meta, or Google Ads." Terms like "ads" and especially "campaigns" are broad and can arise in many unrelated conversations, while the file provides no negative examples or constraints to narrow scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation text is broad enough to trigger on ordinary discussions of email, leads, CRM, or retention, which can cause the agent to inject specialized marketing guidance in contexts where the user did not explicitly request this skill. In an agent environment, over-broad auto-activation increases the chance of unintended behavior, mis-scoped actions, and exposure of business-contact workflows in unrelated conversations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill gives prescriptive automated email and SMS outreach workflows, including timing, sequencing, and property-specific messaging, but does not warn about consent, privacy, opt-out handling beyond a narrow case, carrier rules, or jurisdiction-specific messaging requirements. In practice, this can lead users to automate customer contact using personal data without adequate safeguards, creating compliance, privacy, and reputational risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description says the skill activates when discussing proposals, estimates, job costs, margins, pricing, or profitability, which are common terms that can arise in many unrelated conversations. It does not provide narrower trigger phrases, scope constraints, or negative examples to distinguish when the skill should or should not activate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description says the skill activates when discussing "branding, positioning, competitors, differentiation, or messaging," which are broad business terms that can arise in many general conversations. It does not provide tighter scope, explicit trigger phrases, or exclusion conditions to distinguish when this contractor-focused skill should or should not activate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest says the skill activates when discussing "SEO, rankings, keywords, Search Console, or website optimization," which is a broad set of terms rather than a precise invocation condition. Several of these terms, especially "keywords" and "website optimization," are common in general marketing or web discussions and could cause unintended activation outside the intended contractor SEO context.
- Content