ClawHub
Back to skill

Security audit

revops

Security checks for vulnerabilities and agentic risk

Overview

This RevOps skill is a disclosed guidance package for CRM, lead lifecycle, routing, scoring, and automation workflows, with some privacy-sensitive playbook examples users should scope carefully.

Install only if you want RevOps guidance that may use local product-marketing context and recommend CRM automation patterns. Before implementing the playbooks, limit Slack notifications to need-to-know audiences, avoid unnecessary enriched prospect data in chat, and require consent/opt-out checks before syncing leads to ad platforms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The eval explicitly rewards the skill for triggering on 'casual phrasing' about a vague pipeline problem, which broadens activation criteria without strong scope boundaries. In a routing or agent-selection context, this can cause the RevOps skill to over-trigger on general business troubleshooting requests and lead to misclassification, unintended instruction application, or interception of prompts better handled by another skill.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
Posting enriched lead data to a broad Slack channel can expose internal customer/prospect information beyond need-to-know recipients, especially when enrichment may include sensitive business details. In a RevOps automation context, this is more dangerous because the pattern encourages routine, scalable dissemination of CRM data across tools without any access-control or data-minimization guidance.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Automatically adding leads to retargeting audiences without verifying consent or lawful basis can violate privacy requirements and user expectations, particularly for tracked prospects who have not agreed to ad targeting. In this RevOps playbook, the risk is heightened because the automation operationalizes the transfer at scale across ad platforms.

Static analysis

No suspicious patterns detected.