ClawHub
Back to skill

Security audit

account-scoring

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it scores CRM accounts with an AI agent and writes score fields back, with some deployment checks users should perform first.

Before installing, confirm the four CRM fields exist, use a credential limited to the needed account fields if possible, run cargo-ai cdk plan, test on a small sample, and fix or verify the cargo_last_updated_at timestamp behavior so the weekly re-score gate works as intended.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The code explicitly documents that workflow bodies are compiled rather than executed and that `new Date()` is not available in runtime scope, yet still uses `new Date()` for `cargo_last_updated_at`. This can cause the timestamp write to fail, be serialized incorrectly, or become a compile-time constant, which breaks the freshness gate and can lead to repeated or skipped rescoring of CRM records.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The README explicitly describes an automated workflow that writes scores, tiers, and rationale back into CRM records, but it does not call out safeguards such as approval gates, restricted field scopes, idempotency, rollback, or operator notice that customer records will be modified. In a deployed scoring skill, silent automatic write-back can cause unauthorized or incorrect changes at scale, especially because the values are LLM-derived and may influence downstream sales actions.

Static analysis

No suspicious patterns detected.