Cold Outreach Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:11 PM UTC
• Version: 1.0.0

Overview

The outreach workflow is mostly coherent, but it needs review because its install instructions run mutable latest installer code and bulk-update all installed skills.

Install only after reviewing or pinning the ClawHub installer and required skill versions, and avoid `update --all` unless you intentionally want to update every local skill. Run installation in a least-privileged environment without extra credentials exposed, then provide only the API keys needed for the outreach workflow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:26

Finding

Unpinned Third-Party Package and Skill Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26–30 and 35
Vulnerability Type: Unpinned supply-chain dependency execution
Risk Level: High

Vulnerable Code

bash

npx -y clawhub@latest install apollo-api
npx -y clawhub@latest install linkedin-api
npx -y clawhub@latest install yc-cold-outreach
npx -y clawhub@latest install cold-email
npx -y clawhub@latest update --all

The same unpinned package is subsequently invoked for verification:

bash

npx -y clawhub@latest list

Technical Analysis

The documented commands use npx -y to download and execute clawhub@latest. The latest tag is mutable, so the code executed at installation time may differ from the version reviewed when this skill was published. The -y option suppresses the normal installation confirmation, further reducing opportunities for operator review.

Although the document records specific inspected versions of the four upstream skills, the installation commands do not pin those versions. Consequently, later or compromised releases may be installed without a review of their code, instructions, permissions, or dependency trees.

The command update --all broadens the effect beyond this skill’s four declared dependencies. It may replace unrelated locally installed skills with newer, unreviewed releases. No checksum, signature, lockfile, trusted digest, or post-download integrity check is required by the documented workflow.

This is a supply-chain weakness rather than evidence that the currently referenced packages are malicious.

Attack Path

1. An attacker compromises the package registry account, publication pipeline, mutable distribution tag, or one of the referenced skill releases.
2. The attacker publishes a modified package or skill under the version selected by latest or by an unversioned installation request.
3. An agent or operator follows the commands in SKILL.md.
4. npx -y downloads and executes the modified clawhub package with ...[truncated 1424 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with a specifically reviewed version:

   bash

   npx -y clawhub@<reviewed-version> install ...
   

2. Pin every required skill to its inspected version rather than relying on an unversioned installation:

   • apollo-api version 1.0.5
   • linkedin-api version 1.0.2
   • yc-cold-outreach version 1.0.1
   • cold-email version 1.0.5

   Use the package manager’s supported exact-version syntax.

3. Remove update --all from the installation workflow. Update only the explicitly required skills, one at a time, after reviewing release changes.

4. Verify package and skill integrity using trusted signatures or published cryptographic digests. Fail closed if verification cannot be completed.

5. Maintain a lockfile or signed dependency manifest containing exact versions and integrity hashes.

6. Separate installation from normal skill execution. Require explicit operator approval for dependency upgrades rather than allowing an agent to upgrade automatically.

7. Run installation in a sandbox or least-privileged environment with no production credentials in the process environment.

8. Review new releases and their transitive dependencies before changing pinned versions. Document the reviewed digest alongside each version.

9. Use a trusted internal mirror or allowlisted registry where practical, and monitor package ownership or publication changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to execute npx -y clawhub@latest install apollo-api, which pulls and runs the latest published package code at execution time rather than a reviewed, immutable version. If the clawhub package or its distribution path is compromised, this becomes a supply-chain execution vector that can run arbitrary code on the host during install/update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This line again relies on npx -y clawhub@latest, causing execution of unpinned remote package code during installation. Because the skill is designed to orchestrate credentialed tools and requires API keys, compromise of the installer path could expose secrets or alter installed skills silently.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx -y clawhub@latest install yc-cold-outreach introduces the same unpinned code execution risk from the package registry. An attacker controlling or hijacking the package version could execute arbitrary commands, tamper with installed skills, or collect environment data during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This command executes mutable remote installer code via npx with @latest, making the installation non-reproducible and susceptible to registry/package compromise. In the context of a skill that depends on external APIs and local credentials, the blast radius includes credential theft, malicious persistence, or poisoned tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

npx -y clawhub@latest update --all is especially risky because it combines unpinned installer execution with bulk updating of all installed skills. A compromise here could propagate malicious code broadly across the environment and replace previously safe versions with attacker-controlled ones.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Even for a read-only operation like npx -y clawhub@latest list, npx may still fetch and execute the latest package code locally. While the intended action is lower risk than install/update, it still creates an avoidable remote code execution and supply-chain trust issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.