ClawHub
Back to skill

Security audit

Agency Growth Automations

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only agency automation guide with no executable code, but users should be careful with email automation, OAuth credentials, and lead data.

Install only if you want methodology for agency lead and client automation. Before using the paid external workflows, review exactly what Gmail, Airtable, form, and n8n permissions they request, store credentials in the relevant platforms rather than shared files, test with small data sets, and make sure cold email, opt-out, rate-limit, and personal-data handling practices comply with your provider rules and applicable law.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill promotes workflows that use Gmail OAuth, Airtable, forms, and automated outbound/inbound communications, but it does not warn users about credential handling, access scoping, consent, rate limits, or legal/compliance risks of automated email and lead processing. In a skill centered on client acquisition and automation, this omission can lead users to deploy sensitive integrations and outreach flows insecurely, increasing the chance of credential exposure, spam/compliance violations, and mishandling of personal data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.