ClawHub
Back to skill

Security audit

B2B Outbound Sniper

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says in broad terms, but it can automatically add scraped contacts to a live outbound email campaign and stores lead data locally without strong review or retention controls.

Review this carefully before installing. Use separate low-privilege Apify and Hunter credentials if possible, test against a non-sending campaign first, add a manual approval or dry-run step before campaign writes, and avoid running it where plaintext lead files or console logs may be broadly accessible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
scripts/scrape.py:38
Finding

Mutable Third-Party Scraping Actor Can Poison Automated Campaign Input

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/scrape.py:138
Finding

Lead Personal Data Is Persisted and Printed Without Data-Minimization Controls

Content
View full analysis
— {company}") log_add(email, first, last, company, kw["label"]) existing_emails.add(email) seen_this_run.add(email) seen_this_run.add(domain) added_this_kw += 1 added_total += 1 all_leads.append({**job, "keyword": kw["label"]}) ``` ```python # Save results with open(RESULTS_FILE, "w") as f: json.dump({"keywords": KEYWORDS, "all_leads": all_leads}, f, indent=2) ``` The campaign utility prints recipient email addresses and companies: ```python for r in recipients: status = r.get("status", "unknown") email = r.get("email", "") company = r.get("company", "") flag = "🔥" if r.get("opened") else ("❌" if status == "canceled" else " ") print(f" {flag} {email:<45} {company}") ``` ```python if r.status_code in (20 ...[truncated 2023 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/scrape.py:81
Finding

Apify and Hunter API Credentials Are Transmitted in URL Query Parameters

Content
View full analysis
= MIN_CONFIDENCE] def load_existing_campaign_emails(api_key, campaign_id): """Fetch all current recipient emails from Hunter campaign (ground-truth dedup).""" emails = set() offset = 0 while True: r = requests.get( f"https://api.hunter.io/v2/campaigns/{campaign_id}/recipients", params={"api_key": api_key, "limit": 100, "offset": offset}, timeout=15, ) ``` Campaign enrollment uses the same pattern: ```python r = requests.post( f"https://api.hunter.io/v2/campaigns/{campaign_id}/recipients", params={"api_key": api_key}, json=payload, timeout=15, ) ``` The standalone campaign utility also places the key in the query string: ```python r = requests.get( f"https://api.hunter.io/v2/campaigns/{campaign_id}/reci ...[truncated 2023 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

This is another instance of materially misleading description-to-behavior mismatch, specifically around claimed LLM use, use of 'your own email,' outbound sending, and the breadth of the automation. In a security context, overclaiming or misdescribing behavior reduces transparency around network activity, data processing, and third-party contact handling, which increases the risk of unsafe deployment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

This is another instance of materially misleading description-to-behavior mismatch, specifically around claimed LLM use, use of 'your own email,' outbound sending, and the breadth of the automation. In a security context, overclaiming or misdescribing behavior reduces transparency around network activity, data processing, and third-party contact handling, which increases the risk of unsafe deployment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares no explicit tool scope or permissions even though the content describes use of environment secrets, local file writes, and outbound network access to third-party APIs. That mismatch can cause users or a hosting platform to underestimate what the skill can do, especially since it handles API keys and automates external contact ingestion into an email campaign.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill promotes outbound pipeline generation but does not prominently warn that it automates scraping, enrichment, and loading of third-party contacts into a commercial email campaign. In this context, the omission is significant because the skill handles personal/business contact data and enables unsolicited outreach, creating privacy, compliance, and reputational risk for operators.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/hunter_campaigns.py (reported line 32)May include surrounding context.

python
def metrics(campaign_id):
    api_key = load_api_key()
    r = requests.get(
        f"https://api.hunter.io/v2/campaigns/{campaign_id}/recipients",
        params={"api_key": api_key, "limit": 100},
        timeout=15,
    )

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/hunter_campaigns.py (reported line 76)May include surrounding context.

python
def metrics(campaign_id):
    api_key = load_api_key()
    r = requests.get(
        f"https://api.hunter.io/v2/campaigns/{campaign_id}/recipients",
        params={"api_key": api_key, "limit": 100},
        timeout=15,
    )

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scrape.py (reported line 94)May include surrounding context.

python
def metrics(campaign_id):
    api_key = load_api_key()
    r = requests.get(
        f"https://api.hunter.io/v2/campaigns/{campaign_id}/recipients",
        params={"api_key": api_key, "limit": 100},
        timeout=15,
    )

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scrape.py (reported line 108)May include surrounding context.

python
def metrics(campaign_id):
    api_key = load_api_key()
    r = requests.get(
        f"https://api.hunter.io/v2/campaigns/{campaign_id}/recipients",
        params={"api_key": api_key, "limit": 100},
        timeout=15,
    )

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/hunter_campaigns.py (reported line 75)May include surrounding context.

python
"website": website,
        }]
    }
    r = requests.post(
        f"https://api.hunter.io/v2/campaigns/{campaign_id}/recipients",
        params={"api_key": api_key},
        json=payload,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scrape.py (reported line 78)May include surrounding context.

python
def run_apify(token, query, location):
    """Trigger Apify Indeed scrape and return raw results."""
    url = f"https://api.apify.com/v2/acts/{APIFY_ACTOR}/run-sync-get-dataset-items"
    params = {"token": token, "maxItems": MAX_ITEMS}
    payload = {
        "position": query,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scrape.py (reported line 86)May include surrounding context.

python
"country": "US",
        "maxItems": MAX_ITEMS,
    }
    r = requests.post(url, params=params, json=payload, timeout=300)
    r.raise_for_status()
    return r.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script automatically pushes harvested contact data into a live Hunter.io campaign with no interactive confirmation, dry-run mode, authorization check, or explicit disclosure at execution time. In an agent/skill context, this creates a real risk of unintended external action and privacy/compliance issues if the skill is invoked with real credentials or against an unexpected target set.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This request adds recipients directly to a Hunter.io campaign, causing an immediate state-changing external action using potentially scraped personal/business contact data. In an autonomous skill, such side effects are security-relevant because they can trigger unwanted outreach, compliance issues, or misuse of the user's account without a strong execution guard.

Content

Scanner excerpt · scripts/scrape.py (reported line 133)May include surrounding context.

python
"website": website,
        }]
    }
    r = requests.post(
        f"https://api.hunter.io/v2/campaigns/{campaign_id}/recipients",
        params={"api_key": api_key},
        json=payload,

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This Hunter.io endpoint reference is part of the same state-changing recipient-add flow and therefore represents a real externally mutating action, not just passive transmission. In the context of an autonomous outbound skill, that increases the chance of unreviewed bulk outreach or account misuse if invoked improperly.

Content

Scanner excerpt · scripts/scrape.py (reported line 134)May include surrounding context.

python
}]
    }
    r = requests.post(
        f"https://api.hunter.io/v2/campaigns/{campaign_id}/recipients",
        params={"api_key": api_key},
        json=payload,
        timeout=15,

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script persists scraped lead and tracking data to local files without notice, minimization, retention controls, or file-permission hardening. This can expose personal/business contact data to other local users, backups, or later unintended reuse, especially on shared systems or agent hosts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.