ClawHub
Back to skill

Security audit

public-relations

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a public-relations advice skill, but it encourages aggressive journalist contact discovery and scraping that users should review carefully.

Install only if you are comfortable supervising journalist research yourself. Use publicly provided contact channels, respect journalists' stated preferences and anti-spam rules, avoid scraping where site terms disallow it, and do not let the agent use logged-in browser sessions for bulk profile collection without explicit approval.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/newsjacking.md (reported line 204)May include surrounding context.

md
- **Tragedy-jacking** — Oreo's 2013 Super Bowl tweet worked. Most attempts since have not. Wartime, disasters, deaths: don't.
- **The forced fit** — "Here's our take on [trending story] — it's actually about [our product]." Journalists see through this instantly.
- **The empty take** — pitching "we have an opinion" without specifics. Journalists need a quote-worthy line, not "we're closely watching this."
- **Speed without judgment** — being first with a bad take is worse than being late with a good one. The 30-minute "is this brand-appropriate?" gut check exists for a reason.
- **Pitching the same angle to 50 journalists** — they talk. Get caught once, lose the relationships.
- **No follow-through** — pitch goes out, journalist responds in 20 minutes, founder takes 6 hours to reply. Story moves on.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The guidance encourages guessing journalists' email patterns and then 'bounce-checking' them, which can lead to unsolicited contact attempts, validation of personal contact data, and behavior resembling email harvesting. In a PR workflow this exceeds simple advisory content and nudges users toward questionable reconnaissance practices that can violate privacy expectations, anti-spam policies, or platform terms.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation explicitly recommends using a persistent browser session with 'no rate limits' to scrape outlet, X/Twitter, and LinkedIn pages. That framing encourages bulk collection and automation against third-party services, potentially bypassing normal access controls or usage constraints and creating privacy, terms-of-service, and abuse risks beyond the stated PR-advisory purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The Google News RSS example hard-codes hl=en-US&gl=US&ceid=US:en, which imposes a specific language and region. Under the policy, locale-specific behavior should either be optional or clearly justified; here it appears as the default without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.