ClawHub
Back to skill

Security audit

account-scoring

Security checks for vulnerabilities and agentic risk

Overview

The skill scores business accounts as described, with approval steps before deployment and bulk processing and optional, narrowly scoped CRM updates.

Review and pin the external installers and dependency revision where possible. Confirm which company fields and internal scoring context may reach AI and search providers. Replace the sample sourcing filter or reuse your existing model, preserving its columns and data. Approve the deployment plan and pilot costs before bulk scoring or enabling the schedule. Keep CRM updates off unless needed, and verify the pilot's CRM fields because connector failures can be absorbed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

Installing cargo-project could support the declared workflow, and Cargo project is explicitly mentioned in the description. However, installation is the entirety of the supplied code, not an implementation detail accompanying scoring behavior. Nothing shown deploys a scoring agent, evaluates companies, schedules rescoring, or writes results. The installed skill's unseen behavior cannot be assumed.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
this file. Then run `node --import tsx evals/contract.mjs` from this skill's folder, followed by

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md
- `node --import tsx evals/contract.mjs` passes against the adapted resources

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · infra/connectors/crm.ts (reported line 13)May include surrounding context.

ts
// Salesforce connector (`cargo-ai project add connector/hubspot`), the same way
// crm-enrichment binds its `crm`. A workspace without that connection fails at
// deploy, not at plan, because binding declares no `config` to typecheck. When
// crm-enrichment is installed too, both files declare the slug `crm`: delete
// this one and import theirs, since one slug declared twice collides at deploy.
export const crm =
  crmWriteback.crm === "none"

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The documented npx skills add command can download and execute an unpinned version of the skills package, making installation dependent on whichever release resolves at execution time. A compromised upstream release could execute with the installing user's permissions; this is a conditional supply-chain risk, not evidence of malicious code, and the reference is to a CLI rather than an MCP server.

Content

No source excerpt is available for this finding.

Missing privacy warning for account scoring through external AI and web-search services.

Medium
Category
Output Handling
Confidence
88% confidence
Finding

The documented workflow combines account rows and internal ICP/rubric context with an external LLM and web search, but provides no guidance on sensitive-data restrictions, provider retention, or approval before processing. Scheduled operation across an entire CRM-derived account universe can amplify unintended disclosure of nonpublic account information or business strategy, although this README alone does not establish exactly which fields reach each provider.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The command runs an unpinned npm CLI through npx and installs a skill from a repository without an immutable revision, exposing the project to upstream supply-chain changes. Although this is not an MCP server reference, the underlying concern is valid: a compromised dependency could execute with the operator's privileges or introduce malicious instructions that the agent is then explicitly directed to read and follow.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

npx skills add getcargohq/cargo-skills --skill cargo-project

text

Then read `.agents/skills/cargo-project/SKILL.md` directly; no session reload is needed. Complete its
bootstrap and use its authoring, state, plan, and deployment rules throughout. Stop before any
template work if the skill cannot be installed or read.

The scoring skill defines a new account-sourcing model with an unapproved market filter, rather than only scoring an existing account universe.

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The model contains an active placeholder sourcing filter, so deploying and syncing it can populate the account universe with companies outside the user's approved scope rather than merely score existing accounts. The file states that syncing replaces rows, creating a risk of removing existing accounts from the model; scheduled scoring can then propagate the incorrect scope into prioritization and, if enabled, CRM updates. The documented standalone-install purpose suggests benign motivation, but comments requiring manual replacement do not enforce that prerequisite.

Content

No source excerpt is available for this finding.