tam-building-advanced

• Outcome: Review
• Latest audit: Nov 13, 2026 · 10:04 PM UTC
• Version: 0.3.0

Overview

ClawScan marks this skill suspicious because it reports that the package installs a separate skill instead of providing its stated TAM-building workflow, alongside security and privacy concerns; some content was only partially inspected.

Consider the suspicious verdict and incomplete scan coverage before installing. Review the installer and fetched skill at a pinned, immutable version, verify the actual workflow and redirect handling, and confirm that any CRM-derived customer data sharing and paid provider calls are approved.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: infra/scripts/company-domain.ts

Finding

Unvalidated short-link redirects permit server-side requests to internal destinations

Content

View full analysis

Impact

An attacker can induce blind HTTP(S) GET requests to loopback, private-network or link-local endpoints reachable from the runtime. This enables unauthorized internal requests and interaction with endpoints that perform actions on GET. Response-body disclosure, credential theft and code execution are not established by the supplied files.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Installing cargo-project could support the declared workflow, but it is the entirety of the supplied code rather than a setup step accompanying a TAM implementation. No provider queries, account merging, classification, CRM comparison, or market estimation are shown. The behavior of the downloaded installer and installed skill cannot be established from this chunk.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

3. **Build.** Adapt, run `node --import tsx evals/contract.mjs`, check, plan, deploy.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md

file. Then run `node --import tsx evals/contract.mjs` from this skill's folder, followed by

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md

- `node --import tsx evals/contract.mjs` passes against the adapted resources

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

md

- **One profile per company, after the merge.** (`infra/plays/profile-company.ts`) The LinkedIn enrich

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

md

(`infra/plays/profile-company.ts`, `infra/settings.ts`) Trust a provider's industry label and services

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command executes an unpinned npm package and installs skill instructions from a repository without an immutable revision. A compromised or unexpectedly changed dependency could execute code with the agent's permissions or introduce malicious instructions; this is a dependency-installation risk, not specifically an MCP-server issue.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

npx skills add getcargohq/cargo-skills --skill cargo-project

text

Then read `.agents/skills/cargo-project/SKILL.md` directly; no session reload is needed. Complete its
bootstrap and use its authoring, state, plan, and deployment rules throughout. Stop before any research
or template work if the skill cannot be installed or read.

CRM-derived customer identities are used as AI Ark lookalike seeds without a privacy warning.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The workflow derives lookalike seeds from CRM closed-won companies and sends them to AI Ark without an explicit check that these customer relationships may be disclosed. Although company domains are generally public, selecting them from private CRM records reveals commercially sensitive customer associations; approval of filters and spending does not necessarily authorize that disclosure.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md

d pair it with Sales Navigator in the coverage query instead of Apollo                         | One more source to profile. The estimate gets better the more independent the list is; a list built from the same providers adds nothing                            |
| `drop-a-source`  | Budget, or a source that adds almost nothing in your market                                          | Remove its connector, its model and its line in the play's filter, and its entries in the contract, in one change                                                                                       | Coverage. Dropping Apollo also removes the census pair the estimate is computed from; pair Sales Navigator with AI Ark and say the estimate is weaker                |
| `growth-signal`  | Growth decides priority in your market                                                               | Add `salesNavigator.findCompanyInsights` after the LinkedIn enrich in the profile play, and a growth column on `tam_acco

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

1 */3 *" }` on each paid source (the 1st of every third month), and `"0 6 2 */3 *"` with `isEnabled: true` on the profile play, the day after. A new company becomes a new account and is profiled; a known one is merged and costs nothing more | Every re-sync re-bills every returned record, including the companies already in the TAM: four times a year at most, and the contract refuses anything more frequent. Re-count Sales Navigator first: a split search drifts over a quarter |
| `fifth-source`   | A source that is good at your market (FullEnrich, free per record)                                   | One more source model with a declared account unification, one more line in the play's filter, and the contract's connector list edited                                                                | Nothing else: Cargo merges it, and the play profiles only the companies it adds                                                                                      |

## What should not change

Redirect resolution downloads page bodies despite documentation claiming header-only traversal.

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

axios.get downloads response bodies even though the script only needs redirect headers, and no response-size limit is configured. A malicious company link or redirect destination can therefore consume excessive bandwidth or sandbox memory; the five-hop limit and timeout do not bound response size, and the code also lacks destination checks against internal addresses.

Content

No source excerpt is available for this finding.

Customer domains are sent to AI Ark without a privacy disclosure.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The instructions explicitly send customer domains, potentially selected from private closed-won CRM records, to AI Ark's countCompanies endpoint. This free count occurs before the later approval checkpoint, so sensitive customer associations can leave the workspace without a disclosure-specific authorization.

Content

No source excerpt is available for this finding.

Apollo's paid sampling step contradicts the stated limits on paid operations during configuration.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The configuration instructions direct the agent to deploy Apollo with a small limit and inspect results before the subsequent budget-approval step. Because Apollo sampling is paid, this creates a path to unapproved spending despite the introductory restriction on paid configuration operations; the small limit reduces but does not eliminate the exposure.

Content

No source excerpt is available for this finding.