ClawHub
Back to skill

Security audit

Pakat Email Marketing

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malware, but it can send real email and modify or delete Pakat mailing-list data without strong built-in confirmation guidance.

Install only if you intend to let the agent operate a live Pakat email-marketing account. Use the least-privileged API key available, require a preview and explicit confirmation for sends, deletes, imports, unsubscribes, and list changes, and handle subscriber/tracking data according to your privacy and consent obligations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
For the raw OpenAPI 3.0 spec, see [references/openapi.json](references/openapi.json).

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger description is broad enough to activate on generic email-related requests, which can route users into a high-impact skill that manages real mailing lists, subscribers, and outbound campaigns. In this context, unintended invocation is dangerous because the skill can perform external state-changing actions against a live third-party service using stored credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

bash
# GET requests
curl -s -H "X-API-KEY: $PAKAT_API_KEY" "https://new.pakat.net/api/{endpoint}"

# POST requests (multipart/form-data)
curl -s -X POST -H "X-API-KEY: $PAKAT_API_KEY" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents creating and sending campaigns and transactional emails but does not require an explicit warning or confirmation before executing actions that contact real recipients. This increases the risk of accidental bulk email, unwanted transactional messages, compliance issues, and reputational damage if the agent proceeds from ambiguous user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file lists destructive endpoints such as deleting lists, subscribers, fields, segments, campaigns, templates, and transactional emails, but provides no warning that these actions may be irreversible or affect user data. Under the markdown-specific warning criterion, documentation should disclose behaviors that can impact data integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The file documents endpoints for tracking opens, clicks, unsubscribes, and searching subscribers by email across lists, which involve personal data and behavioral tracking. There is no accompanying warning about privacy implications, consent requirements, or careful handling of subscriber data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The spec includes additional administrative capabilities such as sending-domain lookup and quota inspection that are omitted from the manifest description. While lower risk than write operations, hidden administrative endpoints increase the chance of unreviewed data exposure and make the skill's real authority broader than users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill exposes multiple destructive delete operations for campaigns, lists, templates, subscribers, and transactional emails without any warning or confirmation semantics in the manifest. In an agentic context, this makes accidental or prompt-induced irreversible deletion more likely, especially because the API key appears to permit direct state-changing actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The spec includes additional administrative capabilities such as sending-domain lookup and quota inspection that are omitted from the manifest description. While lower risk than write operations, hidden administrative endpoints increase the chance of unreviewed data exposure and make the skill's real authority broader than users expect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.