ClawHub
Back to skill

Security audit

optimizador-cta-formula100k

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only Spanish CTA optimization skill with no executable code, persistence, or hidden data movement.

Install this if you want a Spanish CTA copywriting assistant. Be aware it may trigger on broad requests about improving video endings or engagement, and it may use available business/profile context such as rubro, offer, lead magnet, or keyword to tailor suggestions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

La skill define disparadores muy amplios como 'mejorar un CTA', 'optimizar el final de un guion' o 'quiero que genere más engagement', lo que puede hacer que el agente la active fuera de contexto y desplace instrucciones más adecuadas. Esto no parece malicioso, pero sí aumenta el riesgo de enrutamiento incorrecto, respuestas irrelevantes y comportamiento no deseado del agente ante solicitudes ambiguas.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

La skill está redactada e instruye operar en español sin ofrecer adaptación automática ni elección de idioma, lo que puede degradar la experiencia, provocar malentendidos y respuestas inadecuadas si el usuario interactúa en otro idioma. En un sistema multiusuario o multilingüe, esta rigidez puede causar activación correcta pero ejecución deficiente.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.