ClawHub
Back to skill

Security audit

Micro-Influencer Finder

Security checks for vulnerabilities and agentic risk

Overview

This is a marketing planning skill that gives templates and evaluation criteria for finding micro-influencers, with no executable code or hidden system access.

Reasonable to install for campaign planning. Use it as a planning aid, not an automated outreach or profiling system, and rely on lawful, platform-permitted, public, aggregated, or creator-provided analytics when assessing audiences.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
|---|---|---|---|
| Search methodology | Multi-platform search using hashtags, competitor analysis, audience overlap tools, and customer-base mining | Hashtag search on 2+ platforms | Manual browsing or single hashtag search |
| Audience analysis | Verifies audience demographics, location, engagement authenticity, and overlap with target customer | Checks follower count and engagement rate | Judges by follower count alone |
| Engagement vetting | Calculates true engagement rate excluding bot activity, analyzes comment quality, and tracks story engagement | Checks likes-to-follower ratio | Uses platform-reported engagement without verification |
| Content alignment | Reviews 30+ posts for brand safety, aesthetic fit, messaging tone, and competitor partnerships | Reviews recent 10 posts for general fit | Glances at bio and top 3 posts |
| Cost analysis | Models CPE, projected CPA, and ROAS against paid ads with historical benchmark data | Calculates CPM and CPE | Negotiates without benchmarks |
| Contract structure | Defines deliverables, usage rights, exclusivity, payment terms, and performance bonuses | Lists deliverables and payment | Informal DM agreement |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly instructs users to verify or estimate audience demographics such as age, gender, geography, language, and income/lifestyle indicators without any privacy, consent, or data-minimization guidance. While this is framed as marketing analysis, inferring or collecting sensitive demographic attributes can create privacy, profiling, and compliance risks if users gather non-public data or make unsupported inferences about individuals.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.