ClawHub
Back to skill

Security audit

Lead Enrichment Scanner

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches lead enrichment, but its code collects scraped emails and includes outreach-draft generation that the user-facing docs say is not implemented.

Install only if you are comfortable with a lead-enrichment tool scraping public company homepages, saving discovered email addresses, and sending company or lead text to MiniMax when MINIMAX_API_KEY is set. Review the code/docs mismatch around outreach drafts and personal email handling before using it for production or outreach workflows.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
# Allow env override
    env_level = os.environ.get("CLAWHUB_LOG_LEVEL", "").upper()
    if env_level in ("DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"):
        level = getattr(logging, env_level)
    logging.basicConfig(
        level=level,
        format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The configuration defaults and CLI expose a `no_personal_emails` control, suggesting the tool will avoid collecting personal email addresses. However, the actual extraction logic indiscriminately harvests email addresses from page HTML and never consults that setting before storing them in output.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code sends prompt content to the remote MiniMax API, and those prompts include lead/company details gathered during enrichment and draft generation. While the code logs missing-key and HTTP errors, it does not clearly disclose to the user that input-derived business data will be transmitted to a third-party LLM service before doing so.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The skill reads the MINIMAX_API_KEY environment variable to authenticate outbound API calls. Although this access is expected for LLM usage, there is no explicit user-facing warning in the command interface or surrounding comments that the skill depends on and will read this credential from the environment.

External Transmission

Medium
Category
Data Exfiltration
Content
)
            LLM_API_KEY_MISSING_WARNED = True
        return None
    base_url = "https://api.minimax.chat/v1"  # pinned, no env override
    try:
        data = json.dumps({
            "model": model,
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def get_llm_api_key():
    """Scope to MINIMAX only — no credential bundling."""
    key = os.environ.get("MINIMAX_API_KEY")
    if key:
        return key, "MINIMAX_API_KEY"
    return None, None
Confidence
70% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Static analysis

No suspicious patterns detected.