Insurance Private Domain Ops

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:03 AM UTC
• Version: 2.0.0

Overview

This is a documentation-only insurance CRM skill with privacy-sensitive use cases, but its behavior is disclosed, purpose-aligned, and not backed by executable code or hidden persistence.

Install only from a trusted registry, preferably with pinned package versions. Before using this skill with real insurance customer data, confirm lawful authority, customer consent, opt-out handling, data minimization, access controls, and human review for personalized outreach or sensitive segments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:21

Finding

Unpinned Third-Party Packages Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 21 and 46
Vulnerability Type: Unpinned and integrity-unverified third-party dependencies
Risk Level: Medium

The Quick Start instructions contain the following command in both the English and Chinese installation sections:

bash

npx clawhub install @gechengling/insurance-private-domain-ops-expert

Technical Analysis

The command invokes clawhub through npx without specifying a trusted version. If the package is not already available locally, npx may retrieve and execute its current release from the configured npm registry. The command also installs @gechengling/insurance-private-domain-ops-expert without pinning its version or verifying its integrity.

Both dependencies are therefore mutable after this audit. A compromised maintainer account, package takeover, malicious release, registry compromise, or dependency-confusion condition could cause users following the documented instructions to execute package content that was not included in the reviewed project. Depending on npm behavior and package composition, execution could occur through the CLI entry point or package lifecycle scripts.

No evidence indicates that the packages are currently malicious. The risk arises from recommending execution of future, unreviewed package versions without version or integrity controls.

Attack Path

1. An attacker compromises the clawhub package, the referenced scoped package, a maintainer account, or the package distribution channel.
2. The attacker publishes a malicious release under the same package name.
3. A user follows the README and runs the unpinned npx clawhub install command.
4. npx resolves and downloads mutable package content from the configured registry.
5. The malicious CLI code, installation logic, or lifecycle scripts execute in the user's environment.
6. The payload operates with the privileges and accessible resources of ...[truncated 792 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer CLI to a reviewed version, for example:

   bash

   npx --yes clawhub@<reviewed-version> install @gechengling/insurance-private-domain-ops-expert@<reviewed-version>
   

2. Replace the placeholders only with versions that have been independently reviewed and approved.
3. Use a trusted or organization-controlled package registry and enforce namespace controls to reduce dependency-confusion and package-takeover risks.
4. Verify package provenance, signatures, or published integrity hashes before installation.
5. Disable package lifecycle scripts where compatible with the installation workflow, or inspect them before execution.
6. Run installation in a least-privileged, isolated environment without production credentials or sensitive environment variables.
7. Keep a lockfile or equivalent immutable dependency manifest when the surrounding package-management workflow supports one.
8. Update both duplicated commands at README.md lines 21 and 46 so that neither section continues recommending an unpinned installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises customer analysis, personalized scripts, and batch touch templates for insurance customers but gives no warning about handling sensitive personal, financial, or potentially health-related data. In an insurance context, this omission is risky because operators may input regulated customer data into the tool without considering consent, minimization, retention, or disclosure obligations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx clawhub install @gechengling/insurance-private-domain-ops-expert without pinning an exact package version. This can cause users to fetch whatever package version is current at execution time, increasing supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README specifically promotes analyzing lapsed customers and generating reactivation workflows, yet omits warnings about privacy, lawful basis, and data-governance controls for re-contacting former customers. Given the domain is insurance and WeChat-based customer operations, misuse could lead to inappropriate profiling, unauthorized outreach, or exposure of sensitive customer status information.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The second install example repeats the same unpinned npx clawhub usage pattern, which exposes users to the same supply-chain substitution and unexpected-update risks. Because this is documentation users are likely to copy-paste, the unsafe pattern directly increases the chance of insecure installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list is very broad and includes generic CRM, retention, and customer lifecycle terms without boundaries, negative examples, or explicit invocation constraints. That increases the chance the skill activates in unrelated conversations and steers the agent into privacy-sensitive insurance marketing workflows involving regulated customer data and outreach recommendations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly encourages AI-generated personalized outreach using customer tags, lifecycle stage, and policy status, including policy information in messages, but does not provide a strong user-facing warning or hard safety gate for privacy-sensitive processing. In the insurance context, this can facilitate large-scale profiling and targeted contact using personal and potentially sensitive financial/health-related data, creating regulatory, privacy, and misuse risks even though the document mentions compliance at a high level.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file consists wholly of Chinese-language instructions and reference material, and it does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The SOP prescribes repeated outreach over enterprise chat and SMS based on inactivity, but it does not mention verifying marketing consent, honoring opt-outs, limiting use of personal data, or complying with privacy and anti-spam rules. In an insurance private-domain operations context, this can drive unauthorized processing of customer data and repeated unsolicited contact, creating privacy, regulatory, and reputational risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The README states the skill is built for China's WeChat ecosystem and China life insurance companies, indicating a locale-specific operational context. Because the description does not explicitly offer users a language/locale choice or present this as an opt-in regional mode, it may conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The content calendar and customer segmentation tables encourage recurring promotional touchpoints and targeted messaging, but they omit privacy safeguards such as consent checks, audience eligibility rules, and restrictions on profiling based on customer attributes. While this is less acute than the explicit reactivation workflow, it still normalizes marketing activity without addressing data-protection and communications-compliance obligations.

Content

No source excerpt is available for this finding.