ClawHub
Back to skill

Security audit

Foxreach Cold Outrach

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its FoxReach outreach-management purpose, but it gives agents live campaign-sending and data-changing authority while showing unsafe API-key and production-action examples.

Review before installing. Use this skill only with a FoxReach API key you are comfortable granting to an agent, prefer environment or secret-manager injection, avoid pasting keys into source or shell history, and require explicit approval before creating, updating, deleting, assigning, or starting campaigns that could send real email.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:24
Finding

API Key Exposure Through Command-Line Arguments and Generated Source Code

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This workflow culminates in adding leads, assigning sending accounts, and starting a campaign, which can trigger real outreach or scheduling of emails to actual recipients. In this skill's domain, that is especially risky because the normal purpose is outbound email automation, so example code can be copied into production and cause unauthorized messaging, compliance issues, or reputational harm.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says to use the skill for 'anything related to the FoxReach API,' which is broad enough to trigger on ambiguous requests beyond the user's precise intent. Overbroad invocation can cause the agent to access or manipulate outreach data, campaigns, inbox content, or analytics when a narrower or read-only action would have been more appropriate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill correctly says to obtain the API key from the user or environment, but then demonstrates a primary usage pattern with FoxReach(api_key="otr_USER_KEY_HERE"), which normalizes putting secrets directly into source code. In practice, users and agents often copy examples verbatim, causing API keys to be embedded in scripts, command histories, logs, or repositories where they can be exposed or reused unintentionally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The one-liner example embeds otr_... directly in Python code even though the surrounding text recommends environment variable injection. This inconsistency materially increases the chance that operators will paste real secrets into shell commands, where they may be captured in terminal history, process listings, notebooks, or support logs.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The examples encourage printing lead email addresses and retrieving full reply or thread content, which can expose personally identifiable information and sensitive business communications in agent output. In an LLM-agent setting, such output may be shown to the user, stored in transcripts, or forwarded to logging/telemetry systems, expanding the disclosure surface.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The auto-paging example iterates through all leads and prints every email address, which semantically promotes bulk extraction and disclosure of stored contact data. In a skill intended for outreach management, bulk PII exposure is more dangerous because the underlying dataset is likely to contain large volumes of prospect and reply information.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

md
| Setting | Value |
|---------|-------|
| Base URL | `https://api.foxreach.io/api/v1` |
| Auth Header | `X-API-Key` |
| Key Prefix | `otr_` |
| Rate Limit | 100 requests/minute |

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-reference.md (reported line 7)May include surrounding context.

md
| Setting | Value |
|---------|-------|
| Base URL | `https://api.foxreach.io/api/v1` |
| Auth Header | `X-API-Key` |
| Key Prefix | `otr_` |
| Rate Limit | 100 requests/minute |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The API reference exposes destructive and campaign-affecting operations such as deleting leads/templates/accounts, starting or pausing campaigns, and assigning leads/accounts without any warning about irreversible effects, sending consequences, or the need for explicit user confirmation. In an agent skill context, this increases the chance that an LLM-driven workflow triggers real outbound email activity or data loss from ambiguous user prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

These examples create, update, and delete live lead records without any surrounding warning that the actions will modify real account data when used with a valid API key. In an agent skill context, examples are often reused as implementation patterns, so omission of safety guidance can cause unintended data creation, overwrites, or deletion in production environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The inbox example changes thread state, category, and star status on what may be a live communication record, but provides no warning that it alters production inbox metadata. While lower impact than sending or deleting data, it can still interfere with triage workflows, analytics, or auditability if used carelessly.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:44