ClawHub
Back to skill

Security audit

FlashRev AI Enrich

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for FlashRev CSV enrichment, but its optional customer_api feature gives broad third-party and internal-network request authority that deserves human review before installation.

Install only if you trust FlashRev and are comfortable with an agent enriching lead data through its CLI. Treat contact enrichment as paid data access, keep FLASHREV_API_KEY out of files and outputs, require dry-run and sample review before live runs, and do not use customer_api or --allow-internal-targets unless you have confirmed every destination and mapped field. In sensitive corporate or cloud environments, restrict outbound network access because the documented customer_api guardrail does not fully prevent DNS rebinding to private or metadata services.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
references/api_contract.md:172
Finding

DNS Rebinding Can Bypass customer_api Internal-Target Filtering

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:288
Finding

customer_api Exposes Approval-Gated Arbitrary Egress and Internal-Network Access

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

md
- `--capability X --prompt "..."` together: `--capability` wins, `--prompt` is ignored with a stderr warning (no routing token charged).
- Unroutable prompts (e.g., "make me a sandwich") exit non-zero with the LLM's reasoning printed; zero rows run.

Agents must skip prompt routing unless the user explicitly requests it. `schema --json` plus explicit `--capability ID` is cheaper, faster, and deterministic.

For contact lookup, agents should use the contact routing table above and pass explicit `--capability`, never prompt routing.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The example normalizes use of --yes to auto-confirm a paid enrichment run, which can bypass an interactive approval checkpoint and make it easier for an agent to execute token- or credit-spending actions without fresh human confirmation. In this skill, some capabilities can also unlock contact data or trigger third-party egress, so encouraging auto-confirmation in examples weakens the approval boundary even though other sections elsewhere call for dry-run and sample preview first.

Content

Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.

md
--capability enrich_email \
  --map first_name=first_name --map last_name=last_name --map company_name=company \
  --output verified_email=verified_business_email
# (preview shown, type 'y' to continue, or pass --yes to auto-confirm)

# 7. audit spend
flashrev-ai-enrich token-history --from 2026-05-01

Static analysis

No suspicious patterns detected.