Clay

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:07 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Clay CLI helper, but users should handle the contact, email, note, and account data it accesses carefully.

Install this only if you intend to give the Clay CLI access to your Clay account. Treat command output as sensitive because it can include personal and third-party contact details, emails, notes, events, locations, birthdays, and interaction history. Confirm contact IDs before update, archive, restore, merge, or group changes, and consider pinning or otherwise verifying the @clayhq/clay-cli package before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party npm CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-20
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

json

{
  "id": "npm",
  "kind": "npm",
  "package": "@clayhq/clay-cli",
  "bins": ["clay"],
  "label": "Install clay (npm)",
},

Technical Analysis

The installation configuration references @clayhq/clay-cli without pinning a reviewed version or specifying an integrity hash. Consequently, installation may resolve to whatever package release is current at that time. The dependency's implementation is not included in the audited project, so its installation scripts and runtime behavior could not be verified.

This CLI is expected to process OAuth authentication and sensitive personal information, including contacts, emails, events, and notes. An attacker who compromises the npm package, its publisher account, or a future release could introduce malicious installation or runtime behavior. This is a supply-chain exposure rather than evidence that the currently published package is malicious.

Attack Path

1. An attacker compromises the npm package, its publisher account, or a future package release.
2. The attacker publishes a malicious version under the legitimate package name.
3. A user installs the Skill dependency without a pinned version or verified integrity value.
4. npm resolves and installs the compromised release.
5. Malicious lifecycle code may execute during installation, or malicious logic may run when the user invokes clay.
6. The compromised process executes with the user's privileges and may access Clay credentials, contact data, or other files available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user installing or running the CLI. The affected scope may include the documented Clay credential file at `~/.config/clay.jso ...[truncated 224 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @clayhq/clay-cli to an exact, security-reviewed version rather than allowing unconstrained resolution.
2. Record and verify the package integrity hash through an appropriate lockfile or trusted installation mechanism.
3. Verify the expected npm publisher, package provenance, signatures, and registry source before installation.
4. Review the pinned package's source code and npm lifecycle scripts, especially code that accesses OAuth credentials or personal data.
5. Disable npm lifecycle scripts during installation where operationally possible, or explicitly document and audit every required script.
6. Establish a controlled dependency-update process that reviews new versions before changing the pin.
7. Prefer a dependency distribution tied to a publicly auditable, immutable source revision.
8. Run the CLI with least privilege and restrict access to ~/.config/clay.json using owner-only filesystem permissions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents commands that retrieve and display highly sensitive personal data including contacts, emails, notes, events, birthdays, locations, and interaction history, but it provides no privacy or data-handling warning. In an agent context, this increases the chance that a model or user will over-collect, expose in logs, or paste sensitive relationship data without recognizing the privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation includes high-impact state-changing operations such as archive, restore, merge, and update without warning that these actions can alter records, remove visibility, or combine data incorrectly. In an agent-driven workflow, ambiguous or unattended execution of these commands can cause accidental data loss, integrity issues, or hard-to-reverse contact-management mistakes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.