DoctorClaw Lead Qualifier

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.0

Overview

This lead-scoring skill is mostly coherent, but it needs review because it can send lead details, update CRM/source records, and includes an unexplained instruction to alert a named person.

Install only if you are comfortable giving the agent access to lead data and any connected email or CRM tools. Before using it, set explicit approved alert recipients and require confirmation for first-time alerts, outreach sends, and CRM/status updates; do not allow the unexplained Stephen alert instruction to route lead details unless that person is intentionally authorized.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:86

Finding

Hard-Coded Alert Recipient May Cause Unauthorized Lead Data Disclosure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 86–89
Vulnerability Type: Hard-coded, unexplained recipient for sensitive lead alerts
Risk Level: Medium

Vulnerable Code Snippet:

markdown

**🔥 HOT (80-100) — Contact immediately**
- Strong fit, high engagement, decision maker
- Draft personalized outreach now
- Alert Stephen immediately

Technical Analysis

The skill explicitly instructs the agent to alert a named individual, “Stephen,” whenever a lead is classified as hot. This recipient is hard-coded independently of the user-configured delivery channel and is not identified as an authorized user, administrator, or sales representative.

Lead alerts may contain personal and commercially sensitive information, including names, email addresses, employers, job titles, engagement history, inferred budget signals, and qualification assessments. If the agent has access to email, messaging, or CRM integrations, it could interpret this instruction as authorization to send that information to a recipient who was not approved by the user.

The issue violates least-disclosure principles and creates an insecure configuration path. The instruction does not itself provide contact information or guarantee that transmission will occur, but an environment that can resolve “Stephen” through contacts, organizational directories, prior context, or connected services may act on it.

Attack Path

1. A user configures a lead source and an outbound notification channel.
2. The skill imports lead records containing personal or commercially sensitive data.
3. A lead receives a score of 80 or higher and is classified as HOT.
4. The agent processes the instruction Alert Stephen immediately.
5. The agent resolves “Stephen” using available contacts, prior context, or a connected messaging service.
6. Lead details are transmitted without verifying that this recipient was explicitly authorized by the user. ...[truncated 579 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the hard-coded recipient instruction with an authorization-bound directive, such as: Alert only recipients explicitly configured and approved by the user.
• Require explicit confirmation before sending the first alert to any newly configured recipient.
• Store recipients in a documented configuration field rather than embedding personal names in skill instructions.
• Validate outbound recipients against an allowlist controlled by the user or organization.
• Apply data minimization by excluding email addresses, engagement details, budget signals, and other PII unless required.
• Record the destination, disclosed fields, approval event, and delivery result in an audit log.
• If no authorized recipient is configured, present the alert only in the current session and do not transmit it externally.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to send outreach emails and update lead status in external systems after user approval, but it does not clearly warn upfront that this involves processing personal data, contacting third parties, and modifying CRM records. In a lead-qualification context, those actions can expose PII, create compliance issues, or cause unintended external communications if users do not understand the privacy and operational impact.

Content

No source excerpt is available for this finding.