ClawHub
Back to skill

Security audit

prospecting

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent B2B prospecting workflow, but it writes web-derived learnings into persistent memory without a clear consent or isolation boundary.

Install only if you are comfortable with a prospecting agent searching third-party sites, compiling public business contact records, and writing local call-list files. Before use, disable or require approval for MEMORY.md/global learning updates, set limits on search expansion and record count, and treat all web page text as untrusted data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:455
Finding

Uncontrolled Cross-Session Modification of Agent Memory

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:455
  • references/post-session-review.md:40-49
  • references/coverage-report.md:94-99

Vulnerability Type: Persistent storage of externally derived information in shared agent memory
Risk Level: Medium

Vulnerable Code Snippets:

SKILL.md:455

markdown
21. **CHAIN BRAND LEARNING** — Maintain a dynamic `chain-brands-detected.json` per search session. If a brand appears in >2 locations, add it to the known chain list for future searches. Share learnings across sessions via MEMORY.md updates.

references/post-session-review.md:40-49

markdown
### 3. Memory Update

Append a concise learning summary to `memory/YYYY-MM-DD.md` under `Prospecting Skill Learnings`:
- New keywords that proved effective
- New center points discovered for a city
- Filter false-positives and how they were corrected
- Chain brands detected
- Any skill bugs or edge cases encountered

Also update `MEMORY.md` with key milestones.

references/coverage-report.md:94-99

markdown
## Usage

1. **Review after run**: Check `coverage_estimate` to see if search was comprehensive enough
2. **Feed into next run**: Use `remaining_gaps` and `chain_brands_detected` to improve Step 0
3. **Share learnings**: Copy `chain_brands_detected` to global `chain-brands-detected.json`
4. **Update MEMORY.md**: Summarize key learnings for cross-session improvement

Technical Analysis

The Skill requires search-derived information to be written to shared MEMORY.md, dated memory files, and a global chain-brand file. These writes are outside the batch-local output directory and are explicitly intended to affect future sessions.

The persisted material originates from Google Maps, business websites, social media, and search results. The workflow does not require user approval, provenance verification, schema validation, namespace isolation, expiration, or roll ...[truncated 2035 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove mandatory writes to MEMORY.md and memory/YYYY-MM-DD.md from the prospecting workflow.
  2. Keep all campaign-derived learning under the batch-specific directory, such as:
    text
    prospect-data/{batch}/session-learnings.json
  3. Require explicit user confirmation before promoting any batch-local information into persistent state.
  4. Store promoted information in a Skill-specific, schema-validated state file rather than general agent memory.
  5. Allowlist fields eligible for persistence, such as normalized brand name, source URLs, observation date, and verified location count.
  6. Never persist raw page text, free-form external instructions, or unverified synthesized claims.
  7. Require multiple independent sources before adding a brand to a global list.
  8. Preserve provenance, including source URL, extraction timestamp, verification status, and approving user.
  9. Add expiration, review, deletion, and rollback mechanisms for persisted entries.
  10. Isolate persistent data by user or workspace so one campaign cannot influence unrelated users.

T01 · Skill Instruction Hijacking

Warning
Location
references/maps-search.md:69
Finding

Untrusted Web Content Is Ingested Without Prompt-Injection Isolation

Content
View full analysis

Vulnerability Details

File Locations:

  • references/maps-search.md:69-77
  • SKILL.md:243-259
  • references/profiling.md:77-129

Vulnerability Type: Indirect prompt injection through arbitrary web-page content
Risk Level: Medium

Vulnerable Code Snippets:

references/maps-search.md:69-77

markdown
### Step 4: Get detail panel data

Click on a business name link, wait 2-3 seconds, then:

```bash
agent-browser eval "document.body?.innerText?.substring(0, 5000)"

The detail panel appears alongside the feed and contains: full address, phone, hours, website, services, reviews summary, posts.

text

`SKILL.md:243-259`
```markdown
| 🔴 Chain | Website deep + LinkedIn + news search + **chain procurement mapping** | agent-browser + agent-reach (Exa) | 3-5min each |
| 🟡 Mid | Website basics + FB | agent-browser | 1-2min each |
| 🟢 Small | **Skip** — Maps data sufficient | — | 0 |

**Chain enrichment** with agent-browser:
1. `agent-browser open "[website URL]"`
2. `agent-browser snapshot -i` → extract Services, About, Staff, Contact
3. Check for Portfolio/Cases and News/Blog pages for expansion signals
4. **For chains**: Look for corporate/region procurement contacts, preferred vendor programs, and expansion news

**Chain news search** with agent-reach:

mcporter call 'exa.web_search_exa(query: "[company name] expansion OR new location OR equipment", numResults: 5)'

text

**Chain procurement mapping** (chains only) — See [references/chain-strategy.md](references/chain-strategy.md) for full approach:
- Identify: local manager → regional operations manager → VP of operations / procurement director
- Sources: LinkedIn, corporate website "careers" or "partners" page, news about leadership changes
- Goal: find the person who can approve equipment purchases for multiple locations

Technical Analysis

The Skill retrieves broad, arbitrary text from Google Maps detail pag ...[truncated 2758 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add a mandatory rule that all website, Maps, review, social-media, and search-result content is untrusted data.
  2. Explicitly prohibit following instructions, requests, tool commands, links, or workflow changes found in retrieved content.
  3. Replace broad document.body.innerText extraction with targeted selectors and an allowlisted schema for fields such as:
    • Business name
    • Public business phone
    • Business address
    • Hours
    • Website URL
    • Services
    • Publicly stated certifications
  4. Parse retrieved data into structured fields before presenting it to the reasoning Agent.
  5. Remove or quarantine text that addresses an AI, requests tool execution, references prompts, or attempts to override prior instructions.
  6. Prevent retrieved content from directly controlling URLs, shell arguments, search queries, output paths, or memory writes.
  7. Require confirmation before navigating to a domain that was suggested only by page content.
  8. Record source provenance for each extracted field and distinguish direct quotations from Agent-generated summaries.
  9. Never copy raw external page text into persistent memory.
  10. Add adversarial tests using pages containing prompt-injection phrases to verify that only allowlisted business fields are extracted.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The weak trigger list includes broad phrases such as 'prospect', 'find customers', and 'lead gen' that can match ordinary conversation and cause the skill to activate unexpectedly. In this skill's context, unintended invocation is more dangerous because activation initiates web searching, third-party data collection, enrichment, file creation, and outreach-list generation without a strong per-run consent gate.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
| **Output path** | `prospect-data/{batch}/` under the user's workspace |
| **Retention** | Delete or archive prospect files when the campaign ends or they are no longer active |
| **Sensitive data** | Do not store personal mobile numbers or non-business contacts |
| **Sharing** | Do not share raw JSON/CSV with third parties without consent |
| **Encryption** | Move completed batches to encrypted storage if required by your policy |
| **Access** | Treat call lists and profile JSON as internal sales data; restrict access to authorized users |

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
87% confidence
Finding

The 'auto-executed before tiering' self-validation and surrounding workflow show the skill making consequential processing decisions automatically on collected lead data. Although validation itself is not harmful, in this skill it is part of a larger autonomous pipeline that classifies prospects and influences outreach readiness without explicit user review.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
Based on Maps data, assign tiers. **Chain stores are NOT excluded** — they are valid prospects with a different approach strategy.

**NEW: Self-Validation Checklist** (auto-executed before tiering)

Before finalizing candidates, automatically verify:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill mandates locale-specific labels such as "连锁-XX" and later requires Chinese tier, priority, CSV headers, and status values in output examples. Because no user opt-in or language selection is offered, the skill effectively forces a specific output language/locale convention.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The CSV schema and status workflow are defined using Chinese field names and status values, which imposes a locale-specific output format on users. The document does not explain that this is region-specific or allow the user to choose English or another locale.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

The skill mandates autonomous behavior such as automatic keyword/center adjustment, suburban expansion, coverage estimation, and reruns without requiring user feedback. In this context, that autonomy directly drives additional third-party searches, larger-scale data collection, and expanded storage/output generation, which can exceed user expectations or policy boundaries.

Content

Scanner excerpt · SKILL.md (reported line 450)May include surrounding context.

md
13. **VERIFICATION REQUIRED** — Before marking any prospect as "ready to call", confirm that the phone number was actually extracted from a live page (not a template). If the number is a placeholder or unverified, flag it explicitly: `"phone_status": "unverified_placeholder"`.
14. **PLACEHOLDER PHONE POLICY** — Output phone numbers must come from real page extraction. Any `555`, `0000`, `1234`, or similar placeholder pattern must be marked `"phone_status": "unverified_placeholder"` and **must not** be written to the `call-list.csv` dial column.
15. **OUTREACH BOUNDARY** — The generated call list is for **business-to-business contact only**. Honor "do not call" requests. Stop calling a prospect upon request and mark status as `"do_not_contact"`. Identify caller, company, and purpose on every call.
16. **DATA RETENTION** — Delete or archive prospect files when the campaign ends. Do not share raw JSON/CSV with third parties without consent.
17. **SELF-OPTIMIZATION IS MANDATORY** — The skill MUST automatically detect coverage gaps and adjust keywords/centers between search passes. Do NOT require user feedback to fix zero-result keywords or missing chain brands. Document all auto-adjustments in `candidates-raw.txt` with `[PASS-N-ANALYSIS]` markers.
18. **COVERAGE GAP REPORTING** — After all passes complete, generate a `coverage-report.json` documenting: (a) which center+keyword combinations returned zero results, (b) which auto-adjustments were applied, (c) estimated coverage percentage of target businesses in the area. This helps users assess completeness without manual review.
19. **SUBURBAN EXPANSION IS AUTOMATIC** — For cities >2M population, if initial 4-6 centers yield <50 unique prospects, auto-expand to 8-10 centers covering satellite cities. For Houston-sized markets, target 80-100+ prospects before stopping. Do NOT require user to ask for "more coverage" — the skill should self-assess and expand.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The tier values in the example output are hard-coded in Chinese (连锁-高端, 连锁-中高端, 连锁-中端) even though the rest of the document is in English and there is no note that output language is configurable or intentionally region-specific. This creates a natural-language locale policy concern because the skill appears to force a specific language format without user opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The checklist explicitly treats placeholder phone numbers as a red flag, but the embedded JSON example uses a 555 placeholder and labels it as an annotation standard. That contradiction can cause downstream agents or users to copy the example verbatim, normalizing fabricated contact data and undermining the integrity controls the document is meant to enforce.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template hard-codes Chinese user-facing text ('搜索完成', '成功获取', '受限', '建议', '已保存') for communication to the user. This is a natural-language locale policy issue because the file does not indicate that Chinese output is optional, user-selected, or required for a region-specific workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The section explicitly labels the extraction patterns as 'Chinese UI' and hard-codes Chinese labels like '网站', '在线预订', '已结束营业', and '正在营业'. This creates a locale-specific constraint in the skill instructions without opt-in, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document directs the assistant to generate and update persistent artifacts such as coverage-report.json, chain-brands-detected.json, memory/YYYY-MM-DD.md, and MEMORY.md after each batch, but it does not require explicit user consent, disclosure, or clear data-retention boundaries. In an agent setting, silent persistence can create privacy, auditability, and cross-session data leakage risks, especially when session-derived information is merged into global memory for future use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill explicitly instructs collection of purchasing decision-maker information from LinkedIn, which expands the profiling from business facts into identifiable personnel targeting without any stated purpose limitation, consent basis, or privacy guardrails. In a sales/prospecting workflow, this creates risk of invasive profiling and downstream misuse for unsolicited outreach or targeted manipulation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The output schema persists contact and profiling data such as phone, address, website, and synthesized business intelligence into reusable JSON files, but the skill provides no retention, access-control, or privacy-handling guidance. Even if much of the data is public business information, centralizing and enriching it increases sensitivity and can facilitate mass prospecting, surveillance, or accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file directs creation of output artifacts such as call-list.csv, profile-{customer-name}.json, and archived raw candidate files, which implies collecting and storing identifiable business contact details. Under the markdown-specific warning rule, the document should disclose that the workflow handles externally sourced contact data and may affect privacy or data-governance obligations, but no such warning appears.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 7)May include surrounding context.

text
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The top-level description emphasizes lead generation outcomes but does not clearly foreground that the skill performs Google Maps searches, website/social enrichment, and stores collected business contact data. Users may invoke it without realizing it will access third-party services and compile prospect records, reducing informed consent and increasing privacy/compliance risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This JSON manifest line describes a workflow action using broad natural language: 'call local first ... then escalate to regional/corporate' without defining when escalation should or should not occur. In a manifest file, such underspecified activation/decision conditions can lead to unintended or overly broad invocation of escalation behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The JSON example uses values such as 连锁-高端, 连锁-中高端, and 连锁-中端, which impose a non-English locale in the skill's natural-language content. The document does not indicate that users can choose language/locale or that the locale is intentionally constrained for a region-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document hard-codes output labels such as "中高端-独立", "连锁-高端", and the JSON example uses a Chinese tier value, which imposes a specific language/locale in the generated output. SQP-3 applies because the file does not offer user opt-in or explain why Chinese output is required for this skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.