ClawHub
Back to skill

Security audit

Outlit SDK

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Outlit analytics integration skill, but it can lead agents to enable broad automatic visitor and identity tracking and includes an unpinned global install path.

Review this skill before installing. It is not evidence of malware, but only use it when you are comfortable adding Outlit telemetry to the target app, and make explicit choices about consent, automatic form capture, email/name identification, persistent fingerprints, retention, and disclosure to end users. Prefer a pinned, local or isolated install path over the unpinned global `npx -y` command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

other

Warning
Location
SKILL.md:129
Finding

Automatic Behavioral and Identity Telemetry May Be Enabled Without Explicit Consent

Content
View full analysis
Remediation
View remediation

other

Warning
Location
SKILL.md:140
Finding

Persistent Device Fingerprinting Enables Broad Pre-Login and Post-Login Identity Correlation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:338
Finding

Unpinned Third-Party CLI Execution and Global Skill Installation Create Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
|-----------|----------------|
| Existing CMP/cookie banner | Initialize with `autoTrack: false`; call `enableTracking()` from the CMP accept callback and `disableTracking()` on revoke/decline |
| EU/privacy signals but no CMP | Use `autoTrack: false` and tell the user they need a consent decision; do not build a CMP unless asked |
| No consent requirement found | Use default `autoTrack: true` |

Explain the tradeoff: `autoTrack: true` creates browser visitor storage immediately. `autoTrack: false` waits until `enableTracking()` is called.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This section promotes tracking and identity collection patterns, including auto-capture and user linking, without an explicit upfront privacy warning or strong instruction to validate legal basis, disclosure, and data-minimization requirements before enabling them. In a telemetry/identity skill, omission of privacy safeguards is risky because it can lead users to deploy broad tracking that captures personal data or behavioral data in ways that violate policy or regulation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run npx -y skills without pinning an exact package version, which causes execution of whatever package version is current at install time. This creates a supply-chain risk: a compromised or maliciously updated package could execute arbitrary code on the user's machine during installation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.