ClawHub
Back to skill

Security audit

SAAS Revenue Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is an opinionated SaaS revenue-analysis guide with no hidden network, credential, persistence, or destructive behavior found.

Install this if you want a lightweight, opinionated framework for reviewing SaaS revenue metrics. Treat its targets and recommendations as business guidance to review against your own context, not as automated financial advice or a production analytics tool.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
Yes, this is a mismatch. The declared description promises a SaaS revenue tracking and analytics capability, but the supplied code chunk does not implement any such functionality. It is an example stub with a print statement and TODO comments only. There are no undeclared sensitive capabilities present, but the actual behavior is materially different from the declared purpose because the code does not perform the advertised monitoring or analysis at all.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The description says 'Use to monitor $1000+ MRR targets, identify optimization opportunities, and keep SAAS products profitable,' but does not define concrete trigger phrases, scope limits, or exclusion conditions. In a markdown skill file, this kind of broad-purpose wording can overlap with many ordinary business-analysis requests and create ambiguity about when the skill should activate.

Static analysis

No suspicious patterns detected.