ClawHub
Back to skill

Security audit

SMB Client Onboarding

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated onboarding-tracker purpose, but it can send a client's contact email and onboarding status to MiniMax without clearly disclosing that full data sharing.

Review this skill before installing if your client names, email addresses, contract values, or onboarding status are confidential. Use it only with data you are willing to store locally in plaintext, and avoid setting MINIMAX_API_KEY unless you are comfortable sending reminder-generation context, including contact email in the current implementation, to MiniMax.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/onboarding.py:344
Finding

Undisclosed and Unnecessary Transmission of Client Contact Email to a Third-Party LLM

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/onboarding.py:72
Finding

Sensitive Client Records Are Created Without Explicit Restrictive File Permissions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
author: "NASSER AL-SOLAITTI"
description: "Local client onboarding tracker. Store client records, track onboarding steps, and generate reminder text via LLM. Use when user says 'track a new client', 'add client onboarding', 'show onboarding status', or 'onboarding checklist'.
permissions:
  - filesystem-write: write onboarding and config data to ~/.openclaw/smb-client-onboarding/
  - env: read MINIMAX_API_KEY from environment (for optional LLM reminder generation)
  - network: send client name and onboarding step context to minimax LLM API when reminder generation is used
privacy: |

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill includes an external LLM integration that transmits onboarding-derived content to a third-party service, even though the primary CLI purpose is onboarding workflow management rather than external AI processing. This expands the data exposure surface and can leak client-related business information outside the local tool's expected trust boundary.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This code establishes network transmission to a third-party LLM endpoint and is later used to send onboarding-related client data. The transmission itself is intentional and over HTTPS, but in this skill context it creates a real confidentiality risk because customer data leaves the local environment for a service not clearly required for core onboarding operations.

Content

Scanner excerpt · scripts/onboarding.py (reported line 127)May include surrounding context.

python
api_key, _ = get_llm_api_key()
    if not api_key:
        return None
    base_url = "https://api.minimax.chat/v1"  # pinned, no env override
    try:
        data = json.dumps({
            "model": "minimax/MiniMax-M3",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 168)May include surrounding context.

python
"gmail": ("https://console.cloud.google.com", "GMAIL_CLIENT_ID + GMAIL_CLIENT_SECRET"),
        "stripe": ("https://dashboard.stripe.com/apikeys", "STRIPE_API_KEY"),
        "hubspot": ("https://app.hubspot.com/private-apps", "HUBSPOT_API_KEY"),
        "slack": ("https://api.slack.com/apps", "SLACK_BOT_TOKEN"),
        "trello": ("https://trello.com/app-key", "TRELLO_API_KEY + TRELLO_TOKEN"),
    }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

At reminder-generation time, the tool sends client name, contact, and stuck onboarding steps to an external LLM without a prominent user-facing warning or consent check. In a business onboarding context, this is sensitive customer and pipeline data, so silent transmission increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Client-provided identifiers and onboarding status details are interpolated directly into the LLM prompt and sent off-host. Even if not code-execution dangerous, this is sensitive data disclosure to a third party and could expose personal contact details, business relationships, and operational status information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The command name and help text say a step will be skipped, but the implementation marks it as complete and records completed_at. This can falsify workflow state, suppress pending-task visibility, and create inaccurate audit/history records for client onboarding steps such as document collection or payment-related tasks.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/onboarding.py (reported line 47)May include surrounding context.

python
level = logging.INFO
    env_level = os.environ.get("CLAWHUB_LOG_LEVEL", "").upper()
    if env_level in ("DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"):
        level = getattr(logging, env_level)
    logging.basicConfig(
        level=level,
        format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",

Static analysis

No suspicious patterns detected.