Prompt injection instructions
Warn
- Finding
- Prompt-injection style instruction pattern detected.
B2B SDR Agent
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This is a coherent AI sales-agent template, but it merits Review because it can autonomously contact customers, persist and reinject customer data, and includes guidance to hide that the agent is AI.
Install only if you are comfortable operating an autonomous sales agent. Before production use, disclose AI involvement to recipients, require human approval for outbound campaigns and quotes, limit API/channel credentials, inspect deploy scripts, and configure retention, deletion, and sanitization for customer memory.
Static analysis
Prompt injection instructions
Warn
- Finding
- Prompt-injection style instruction pattern detected.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
What this means
Customers or leads may believe they are interacting with a human representative, creating consent, compliance, and reputation risks for the business using the skill.
Why it was flagged
The skill's customer-facing behavior explicitly instructs the AI not to reveal that it is AI and to present as a sales consultant, which can mislead external recipients.
Skill content
Nunca revela identidad de IA — se presenta como tu consultor de ventas
Recommendation
Change the persona rules to disclose AI assistance clearly and ensure all outreach complies with platform rules and local marketing laws.
What this means
If configured broadly, the agent could send messages, follow-ups, quotes, or sales commitments to real leads without enough operator review.
Why it was flagged
The skill is designed to perform end-to-end external sales activity across messaging and email channels; the top-level instructions do not clearly require per-message or per-deal human approval.
Skill content
handles lead capture → qualification → follow-up → quoting → closing across WhatsApp, Telegram, and email
Recommendation
Require human approval for first outreach, quotes, discounts, deal-closing language, and bulk campaigns; configure allowlists, rate limits, and audit logs.
What this means
Customer PII, budgets, objections, quotes, and commitments may be retained and reused across sessions; malicious or accidental instructions captured in memory could steer later conversations.
Why it was flagged
The design stores customer conversation data every turn and later injects memory into the system prompt, which can expose sensitive customer/business data and allow untrusted customer text to influence future behavior if not sanitized.
Skill content
ChromaDB Per-Turn Storage — Every turn stored with customer_id isolation ... Add the following dynamic section to the Agent's System Prompt
Recommendation
Treat retrieved memory as untrusted data, escape or label customer-provided text, add retention/deletion controls, and avoid injecting raw customer content into system-level instructions.
What this means
The agent may keep processing conversations, updating memory, and triggering workflows in the background after initial setup.
Why it was flagged
The documented hooks and cron behavior are disclosed and purpose-aligned, but they create continuing background activity beyond a single user-invoked task.
Skill content
auto-execute after each turn ... run as a Cron skill checking for new completed conversations every minute
Recommendation
Make cron jobs opt-in, document how to stop them, and monitor background actions with logs and alerts.
What this means
Misconfigured or overprivileged keys could let the agent access messaging accounts, model accounts, or deployment infrastructure more broadly than intended.
Why it was flagged
The skill expects operational credentials for servers, AI providers, and communication channels. This is expected for an SDR integration, but the registry metadata declares no required credentials.
Skill content
Edit config.sh with your server, API keys, and channel settings
Recommendation
Use least-privilege API keys, separate test and production credentials, rotate secrets, and avoid storing real credentials in repository files.
What this means
Running deployment scripts may modify a server and install or upload code that affects agent behavior.
Why it was flagged
The deployment flow can install dependencies and change the skill set on a target server. This is relevant to the stated deployment purpose, but it expands the trust boundary.
Skill content
deploy.sh now auto-uploads all local skills from `skills/` directory ... auto-installs Python3 + graphify on target server
Recommendation
Review deployment scripts and dependency sources before running them, pin versions where possible, and use a staging environment first.