T09 · Insecure Skill Coding Practices
Error
- Location
memory-manager/memory-manager.js:32- Finding
Path Traversal Allows File Access Outside the Memory Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
Lead Gen Operator
Security checks for vulnerabilities and agentic risk
Overview
This lead-generation skill is mostly aligned with its stated purpose, but it needs Review because it automatically stores lead data, can send email through Gmail, and includes unsafe local file and command patterns.
Install only if you are comfortable with an agent that stores prospect data locally, mutates lead status automatically, and can send outreach through a connected Gmail tool. Review generated recipients and messages before sending, avoid storing sensitive or regulated contact data, keep exports protected, and prefer a patched version that validates memory filenames, avoids shell command construction from web-derived fields, safely serializes CSV, pins dependencies, and documents deletion and retention controls.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
SOUL.md:6- Finding
Shell Command Injection Through Automatically Saved Web-Derived Lead Fields
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
memory-manager/memory-manager.js:283- Finding
CSV and Spreadsheet Formula Injection in Lead Exports
- Content
View full analysis
'); process.exit(1); } const csvData = readFile(args[1]); if (!csvData || !csvData.leads) { console.error('No leads found'); process.exit(1); } // CSV header console.log('ID,Company,Contact,Email,Size,Industry,Funding,Status,Score,Notes,Created,Last Updated'); // CSV rows csvData.leads.forEach(lead => { console.log(`${lead.id},"${lead.company}","${lead.contact}","${lead.email}","${lead.size}","${lead.industry}","${lead.funding}",${lead.status},${lead.score || 0},"${lead.notes || ''}",${lead.created_at},${lead.last_updated || ''}`); }); break; ``` ### Technical Analysis Lead fields are inserted directly into CSV output. Embedded double quotes are not escaped by doubling them, and embedded carriage returns or newlines are not handled safely. An attacker-controlled field can consequently break the expected row or column structure. In addition, spreadsheet applications may interpret cells beginning with `=`, `+`, `-`, or `@` as formulas. Quoting a CSV cell does not reliably prevent formula evaluation. Because lead fields can be obtained from external websites, an attacker can store a formula-like value that becomes active when the user opens the export in a spreadsheet application. ### Attack Path 1. An attacker supplies a company, contact, email, funding value, or note beginning with a spreadsheet formula marker or containing crafted quotes and newlines. 2. The malicious value is added to `leads.json`. 3. The user runs `export-csv` and redirects the output to a CSV file. 4. The export routine inserts the value without standards-compliant escaping or formula neutralization. 5. The user ...[truncated 485 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:10- Finding
Unpinned Installation of Executable Third-Party Packages and Skills
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The skill advertises lead finding and personalized outreach generation, but the described implementation only performs local CRUD/scoring/export and stores data in the user's home workspace. This mismatch is security-relevant because it misleads users about actual behavior, conceals local persistence/export risks, and undermines informed consent for data handling.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
The README instructs users to install a memory manager and copy persistent files into the OpenClaw workspace, establishing session persistence for collected lead data. Persistence is not inherently malicious, but in this skill context it increases risk because the tool handles prospect records, outreach state, and potentially contact details, yet the README does not describe safeguards, scope limits, or deletion controls.
- Content
3. Install Memory Manager Skill
bash mkdir -p ~/.openclaw/workspace/skills/memory-manager # Copy memory-manager.js and SKILL.md from the package
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README states that leads are automatically saved, but it does not warn users that business/contact data will be persisted to disk. This creates a transparency and privacy risk because users may unknowingly store potentially sensitive prospect information locally, where it may be retained longer than expected or exposed through weak file protections.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README advertises that the skill can send outreach emails directly via Gmail, but it provides no indication that this is an outbound side effect requiring explicit user approval. In an autonomous lead-generation context, silent or poorly signaled email sending can cause unauthorized communications, spam, reputational damage, or accidental data disclosure to third parties.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Step 5: Write Outreach
bash node ~/.openclaw/workspace/skills/memory-manager/memory-manager.js \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The guide instructs users to send outreach through Gmail but does not clearly warn that this action transmits messages to external recipients. In a lead-generation context, this can cause unintended outbound contact, privacy issues, or reputational harm if users assume the step is only drafting or internal testing.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill invokes a local Node.js tool under ~/.openclaw/workspace and relies on filesystem and likely environment-backed execution, but it declares no permissions or allowed-tools scope. This creates an authorization and transparency gap: users and the platform cannot accurately evaluate what resources the skill may access or modify before use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill encourages storing lead and contact-related information and exporting it to CSV without warning about local persistence, data exposure, or downstream handling of exported files. This omission can lead users to place sensitive business or personal data into unprotected local files that may be copied, shared, or retained longer than intended.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - **Find leads** - Add companies with details (name, size, industry, funding) - **Auto-score** - Scores leads 0-100 based on funding stage, team size, industry - **Write outreach** - Generates personalized cold emails - **Track pipeline** - Status flows: new → enriched → drafted → sent → replied → closed - **Follow-ups** - Get recommendations on who to follow up with - **Export** - Export leads to CSV
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to persist lead data immediately and without asking the user, which creates unauthorized session-to-session storage of potentially sensitive business contact information. In this context, the danger is elevated because the action is tied to an
execcommand that writes to a persistent leads database, making silent data retention likely and hard for users to notice or control.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The email-sending workflow allows outbound communication and status mutation without requiring an explicit warning or confirmation at the point of action. In a lead-generation skill, sending external emails can create reputational, compliance, and spam risks, and automatically marking records as
sentcan also corrupt pipeline state if triggered accidentally or by prompt manipulation.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
The outreach generation flow auto-saves generated content and updates status to
drafted, creating persistent state changes from a simple content-generation request. While persistence is expected for a CRM-like skill, doing it automatically without clear user consent or visibility increases the risk of silent retention, accidental record modification, and cross-session data buildup.- Content
- Update status to "sent"
OUTREACH GENERATION
Write personalized cold emails:
text Write outreach for [company]
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The bulk send command implies mass outbound action and mass status changes without any safety checks, preview, or confirmation. In this skill context, bulk operations amplify the blast radius of mistakes or prompt-injection-driven misuse, potentially causing large-scale unsolicited outreach and widespread corruption of CRM-style records.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- name: memory-manager description: Read and write JSON data to memory files. Use for persisting leads, contacts, and structured data across sessions. metadata: {"clawdbot":{"emoji":"💾","requires":{"bins":["node"]}}} ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file tells the user to save data using
printf ... > ~/.openclaw/workspace/memory/leads.json, which replaces the entire file contents. The surrounding instructions do not warn that malformed or incomplete JSON could permanently overwrite existing stored leads, contacts, or notes.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The export-to-CSV feature is documented without telling users that lead and contact information will be written to a local file. While lower severity, this can still expose sensitive business contact data through insecure storage, accidental sharing, or syncing to other services.
- Content
Static analysis
No suspicious patterns detected.