ClawHub
Back to skill

Security audit

gingiris-b2b-growth

Security checks across malware telemetry and agentic risk

Overview

This is a static B2B SaaS growth playbook with broad activation wording and one questionable payment-leverage tactic, but no executable behavior or hidden access.

Installers should understand this as advisory business content, not a technical automation skill. Review the broad triggers if you do not want it invoked often, and treat the final-payment leverage advice as something that requires explicit customer agreement, clear data/control boundaries, and legal review before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The guidance includes coercive payment-collection and service-leverage tactics that can pressure operators to retain technical control over customer functionality as commercial leverage. In a skill framed as advisory content, this can normalize unsafe operational practices that may undermine customer autonomy, create disputes over service control, and incentivize misuse of hosting or feature access in ways that carry security and trust risks.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill declares very broad trigger phrases such as "B2B SaaS," "PLG," "SLG," "PMF," and "go to market," which are common terms in ordinary business conversations. This can cause the skill to activate in contexts where the user did not explicitly request this playbook, increasing the chance of irrelevant or unintended prompt injection into agent workflows and crowding out more appropriate skills.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Recommending that customer features remain on the vendor's servers until final payment clears encourages deliberate retention of infrastructure and data-path control as leverage. Without strong disclosure and safeguards, this creates material risks around data custody, continuity, access revocation, and abusive service withholding, especially if the customer assumes they control their deployment or operational environment.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.