lfg

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:53 PM UTC
• Version: 1.0.0

Overview

The skill’s lead-generation purpose is coherent, but it asks users to install unaudited code from an unpinned GitHub repository and handles contact data and API keys with limited safety guidance.

Review the GitHub repository and pin a trusted commit or release before installing. Use restricted Tavily and OpenRouter keys, avoid storing more lead data than needed, and treat generated emails, phone numbers, and LinkedIn URLs as personal data subject to applicable privacy and outreach rules.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:31

Finding

Unpinned Third-Party Repository Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–36
Vulnerability Type: Unpinned and mutable remote dependency
Risk Level: High

Complete Code Snippet:

bash

# From the repo root
pip install -e .

# Or via pipx for isolated install
pipx install git+https://github.com/Catafal/lead-gen-factory.git

Technical Analysis

The Skill instructs users to install software directly from the default branch of a third-party Git repository. The dependency is not pinned to a release version, immutable commit hash, or verified artifact checksum. Consequently, the code installed by this command can change after the Skill has been reviewed.

Python installation can invoke package-controlled build backends or installation hooks. The installed lgf executable subsequently runs with the invoking user's permissions. Because the executable source and package metadata are absent from the audited artifact, its installation behavior, network activity, filesystem access, and handling of TAVILY_API_KEY and OPENROUTER_API_KEY cannot be independently verified.

The local pip install -e . alternative is also not usable from the supplied artifact because the project contains only SKILL.md and no Python package or build metadata.

Attack Path

1. An attacker compromises the referenced repository, obtains maintainer access, or causes malicious changes to be merged into its default branch.
2. The attacker adds malicious installation behavior, build hooks, or runtime logic to the package.
3. A user follows the Skill instructions and runs:

   bash

   pipx install git+https://github.com/Catafal/lead-gen-factory.git
   

4. pipx retrieves the current repository contents rather than a previously audited immutable revision.
5. Package-controlled code may execute during installation or when the user subsequently invokes lgf.
6. The malicious code runs with the user's privileges and may access reso ...[truncated 997 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish the reviewed implementation as a versioned package from a controlled package registry.
2. Pin installation to an immutable release version or full Git commit hash rather than the repository's default branch.
3. Distribute and verify cryptographic hashes or signed release artifacts before installation.
4. Include lockfiles and hashes for transitive dependencies to reduce supply-chain variability.
5. Prefer isolated installation and execution with only the filesystem and network permissions required for lead research.
6. Include the reviewed executable source and package metadata in the Skill artifact so installation hooks and runtime behavior can be audited.
7. Document the exact repository revision reviewed and establish a process for re-auditing dependency updates.
8. Restrict the permissions and quotas of the Tavily and OpenRouter API keys, store the credential file with user-only permissions, and avoid exposing secrets through command-line arguments or logs.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

# SKILL.md — lgf (Lead Gen Factory) skill for Claude Code and OpenClaw.
#
# Compatible with:
#   - Claude Code: auto-loaded from .claude/skills/lgf/SKILL.md
#   - OpenClaw:    publishable to ClawHub → `clawhub install lgf`
#
# The `name` field becomes the /slash-command trigger.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

Granting the skill Write capability, combined with a workflow that produces CSV lead files and updates configuration in ~/.lgf/.env, creates a persistence surface for storing personal data and modifying local session state. In this context, an agent could unnecessarily retain lead data on disk or alter configuration in ways the user did not intend, increasing privacy and integrity risk.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

allowed-tools:
  - Bash
  - Read
  - Write
---

# lgf — Lead Gen Factory

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is explicitly designed to generate lead lists containing personal contact data such as names, work emails, LinkedIn URLs, and phone numbers, but the description gives no warning about handling personal data or legal/privacy constraints. This increases the chance that an agent will collect, surface, or store PII without user awareness, appropriate consent checks, or policy review.

Content

No source excerpt is available for this finding.