ClawHub
Back to skill

Security audit

lfg

Security checks across malware telemetry and agentic risk

Overview

This is a coherent lead-generation CLI skill with expected privacy, API-key, and local-setup considerations but no evidence of hidden or destructive behavior.

Before installing, verify the Lead Gen Factory repository, use pipx or another isolated environment, and use dedicated API keys. Treat generated leads as personal or sensitive business data, review provider terms, and ensure outreach and storage comply with applicable privacy laws, consent requirements, and platform rules.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The skill advertises configuration-changing commands such as `lgf config set KEY VALUE` and `lgf init`, which can modify persistent local settings and secrets outside the immediate lead-research task. In an agent context, exposing these commands increases the chance the model alters user environment state or API key configuration without explicit, narrowly scoped consent.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill is designed to generate lead lists containing personal data such as names, emails, LinkedIn URLs, phone numbers, and employer details, but the description provides no warning about privacy, consent, or data-handling obligations. This omission can cause an agent to collect, surface, or store personal contact data without appropriate user awareness or policy guardrails.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.