Investor Search for PicoClaw

• Outcome: Review
• Latest audit: Sep 21, 2026 · 2:32 PM UTC
• Version: 1.0.2

Overview

This skill appears purpose-built for investor research, but it persistently stores lead-research files and can automatically post a workbook into shared chats, which users should review before installing.

Install only if you are comfortable with the agent creating persistent investor-research files in its workspace and attaching the resulting workbook to the active chat. For shared bots, use a separate workspace per team or user, and avoid running it in public/shared channels unless everyone in the channel should receive the investor list and associated research history.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

| `SKILL.md` | working — every operative rule, nothing else |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

md

attached — only counted. If you run a bot for several people, the safest setup is one agent
per team, each with its own workspace.

**Scheduled runs** (cron jobs) continue a stored market without asking; anything that
would need a question — a different scope, a shared folder — stops before the first search
and reports the question instead.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill clearly expects and instructs use of powerful capabilities including reading/writing workspace files, executing Python, and sending files, yet it declares no explicit tool scope or permissions boundary. That mismatch increases the chance the skill is granted broader access than necessary or is activated in environments where operators cannot easily review or constrain its effective privileges.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The top-level description markets the skill for broad investor research, deal sourcing, CRM enrichment, LP/HNW lead generation, and filling gaps in existing lists, which overlaps many common business requests. An overly broad trigger surface can cause the skill to activate in situations where users did not intend persistent scraping, file retention, or contact-list generation, increasing privacy and misuse risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The 'When to Use' section is expansive and lacks meaningful exclusion criteria, covering a wide range of investor discovery and enrichment scenarios. In context, this is more dangerous because the skill also persists files across runs and can resume from prior data, so accidental activation can silently create or expand a durable research database.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The instruction to send the generated Excel file to the chat 'WITHOUT asking' authorizes autonomous disclosure of collected data. In a channel context, that can expose investor lists, source links, and accumulated workbook contents to unintended recipients, especially because the skill is designed to preserve and resume prior runs from shared storage.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

(Slack, Telegram, file it printed (relative to the workspace is fine) — ONE file, Discord, WeCom, …) -investors.xlsx, arrives as an attachment in this chat. Never attach the CSVs: they are the memory, not the deliverable. Send it WITHOUT asking — in a channel too (see §6). CLI (picoclaw agent) state the path. cron job send_file in the job's run; it goes to the job's chat.

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

Automatically posting the finished Excel file to everyone in a channel after only an initial notice still constitutes autonomous disclosure to a broad audience. The surrounding skill context makes this riskier because shared workspaces may contain runs not started by the current user, so the file could expose historic or cross-user data without a fresh consent check.

Content

Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.

md

(*PicoClaw* above).

**In a channel, say once in the first reply that the finished Excel file will be posted
here for everyone in it.** That notice is the only one: at the end, post the file without
asking again.

**Use a separate root per user or team whenever the session context names one.**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 691)May include surrounding context.

md

**There is no budget unless the user sets one.** By default the run continues until the
exhaustion rule is met — six empty rounds in a row, with the gates open — and `finish` allows
the stop. **Never ask the user for a budget.** If the user names a number ("use 10 rounds",
"quick scan"), pass it as `init --budget N`. **Sixty rounds is the backstop** for a run
without a budget; a user who explicitly asks for more gets their number after one sentence
on what it costs.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These lines require the market folder to use the English short name and explicitly forbid local-language names or user-provided variants. That is a language-policy constraint stated as mandatory behavior, and the file does not offer the user a language choice or document a user opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guidance explicitly allows use of a file-send mechanism into a shared channel, noting that everyone in the channel can receive the file if sent there. Even though it tells the agent to ask first, this still creates a real confidentiality risk because investor research outputs and working files may be disclosed to unintended recipients through normal operation rather than a separate exploit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The text endorses a 'plain English query' as the successful corrective action and later contrasts English against local languages as the winning approach in multiple markets. Because this is natural-language guidance in a markdown file and it does not offer user choice or frame the locale preference as optional, it can be read as a language-policy preference without opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The deliver command packages not only the user-facing investor list but also Pending, Rounds, and Ledger sheets into the file sent to the user. Those sheets expose internal run history, search strategy, completeness heuristics, and carry-forward state that are not necessary for the promised deliverable and may reveal operational metadata or sensitive research context. In this skill context, that is more dangerous because the tool is explicitly used for prospecting and hand-offs, so the delivered workbook is likely to be widely shared externally.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document discusses shared-workspace layout but does not surface the broader confidentiality risk at the point where files are first written, which can cause users or agents to persist sensitive research in locations visible to other users. This is a security weakness in workflow design because exposure can occur even without using the explicit file-transfer step.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The module docstring presents the store as 'the only way this skill writes its files' and 'Append-only,' suggesting tightly constrained write behavior. In practice, the module also renames ledger-uploaded*.txt files to .hold and back during import, creates temp directories/files, and rewrites CSV/index/ledger outputs, which is broader than the docstring's stated model.

Content

No source excerpt is available for this finding.