Security audit

Sales Automation Workflows Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its n8n business-automation purpose, but it needs review because it declares an unexplained unpinned Node package install and uses broad activation phrases.

Review this skill before installing. It appears intended to help build n8n automations, but users should understand why the clawhub Node package is installed, prefer a pinned and reviewed package version, and only let generated workflows act on production CRMs, email, social, payment, or ecommerce systems after checking credentials, permissions, and rollback steps.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: skill.md:6
Finding: Unpinned and Unexplained Node Package Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad and generic (e.g. 'automate workflow', 'connect apps', 'business automation'), making it likely this skill will activate on many ordinary user requests that are not specifically asking for this agent. Overbroad activation can cause inappropriate routing, unexpected tool use, and expanded exposure to any risky behaviors or dependencies defined by the skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.