mailgo-coldmail-marketing

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:15 AM UTC
• Version: 1.1.2

Overview

This package is a disclosed deprecation notice that manually points users to a replacement skill, but users should verify the new publisher before migrating.

Before following the migration commands, confirm that @leadsnaviDeveloper is the intended successor publisher and review the replacement skill's contents and permissions. Prefer a pinned or reviewed replacement version if ClawHub supports that.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Skill Replacement from a Different Publisher

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6–13
Vulnerability Type: Supply-chain risk caused by installing an unpinned external skill from a different publisher
Risk Level: Medium

markdown

This skill has been migrated from **@cailumin** to **@leadsnaviDeveloper** on [ClawHub](https://clawhub.ai/).

The version under @cailumin is now **deprecated** and will no longer receive updates.

Please install the latest version from the new account:

```bash
clawhub uninstall @cailumin/mailgo-coldmail-marketing
clawhub install @leadsnaviDeveloper/mailgo-coldmail-marketing

text

### Technical Analysis

The document instructs users to uninstall the existing skill and install an externally maintained replacement under a different publisher identity. The installation command does not pin a reviewed version, cryptographic digest, or verified release signature. As a result, the content ultimately installed is outside this audited project and may change after review.

The project provides no locally verifiable evidence that the original and replacement publisher accounts are controlled by the same trusted party. This does not prove that the replacement is malicious, but it creates a supply-chain trust boundary that users cannot validate from the package itself.

### Attack Path

1. An attacker compromises or otherwise gains publishing control over `@leadsnaviDeveloper/mailgo-coldmail-marketing`.
2. The attacker publishes a malicious revision under the same unpinned package identifier.
3. A user follows the instructions in `SKILL.md` and removes the existing package.
4. The user runs the unpinned installation command.
5. ClawHub resolves the identifier to the attacker-controlled revision.
6. When the replacement skill is loaded or invoked, its malicious instructions or code execute within the permissions available to the ClawHub client or invoking agent.

### Impact Assessment

Exploitation could exp
...[truncated 497 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the replacement to a specific, reviewed version rather than installing the mutable latest release.
• Verify a cryptographic digest or publisher signature when supported by ClawHub.
• Publish a verifiable migration statement signed by the original publisher or linked through an independently trusted channel.
• Review the replacement package's complete contents and requested permissions before installation.
• Install and validate the replacement in an isolated environment before removing the existing skill.
• Apply least-privilege restrictions to the ClawHub client and installed skill, limiting filesystem, credential, tool, and network access.
• Document a trusted rollback procedure and retain the previously reviewed version until migration validation is complete.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.