ClawHub
Back to skill

Security audit

Ai Lead Generator Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill does not show malware-like behavior, but it needs review because it advertises real lead collection, LinkedIn/Apollo automation, and compliance while the code only creates synthetic CSV data and provides little privacy scoping.

Install only if you understand that the current code appears to generate synthetic CSV leads, not real Apollo.io or LinkedIn results. Treat the advertised personal-data collection and GDPR claim cautiously, and do not use it for real contact scraping or outreach unless you have a lawful basis, consent/compliance controls, and reviewed the dependencies.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly promotes collecting, validating, and exporting personal contact data such as direct email addresses and phone numbers, but it does not warn users about privacy, consent, jurisdictional restrictions, or misuse risks. In this context, omission of a warning is security-relevant because the skill is designed for large-scale lead generation and data export, which can facilitate privacy violations, spam campaigns, or improper handling of personal data.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The top-level docstring says the skill 'Generates qualified B2B leads using Apollo.io and LinkedIn automation,' which implies real external-source lead collection or automation. In reality, the code explicitly states it is simulated, creates synthetic sample data locally, and never uses Apollo, LinkedIn, or even the imported HTTP client.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "Billy Overlord <billytheinternetoverlord@gmail.com>",
  "license": "MIT",
  "dependencies": {
    "csv-writer": "^1.6.0",
    "axios": "^1.6.0"
  },
  "openclaw": {
Confidence
96% confidence
Finding
The dependency uses a caret version range, which allows newer minor/patch releases to be installed without explicit review. This weakens build reproducibility and can introduce vulnerable or malicious upstream changes into the skill supply chain over time.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "MIT",
  "dependencies": {
    "csv-writer": "^1.6.0",
    "axios": "^1.6.0"
  },
  "openclaw": {
    "skill": true,
Confidence
98% confidence
Finding
The axios dependency is not pinned, so different installations may resolve to different releases. Because axios has a history of security advisories, leaving the version range open increases the chance of pulling in a vulnerable release or creating uncertainty about whether deployments are affected.

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
87% confidence
Finding
The manifest references axios with a non-exact version, while the package has multiple known advisories across versions. Without a pinned version or lockfile evidence, it is not possible to verify that installations avoid affected releases, creating a real supply-chain and runtime risk for a network-facing lead-generation skill likely to process external URLs or HTTP responses.

Static analysis

No suspicious patterns detected.