ClawHub
Back to skill

Security audit

Prospect Enrichment

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate company-research purpose, but its command examples put user-provided company names and URLs directly into shell commands and it does not clearly warn users before sending prospect data to external services.

Review this skill before installing. It is suitable for prospect research, but users should avoid running it on confidential or non-public prospect lists without authorization, and maintainers should add explicit consent, input validation, and safe CLI invocation guidance before agents execute the Firecrawl or Exa commands.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:41
Finding
Command Injection Through Unsafely Interpolated Prospect Input<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:41`, `SKILL.md:47-49`, `SKILL.md:61`, `SKILL.md:82`, `SKILL.md:88`, `SKILL.md:94`, `SKILL.md:100`, and `SKILL.md:106-108` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash node tools/clis/firecrawl.js scrape [prospect-url] ``` ```bash node tools/clis/firecrawl.js scrape [prospect-url]/about node tools/clis/firecrawl.js scrape [prospect-url]/pricing node tools/clis/firecrawl.js scrape [prospect-url]/team ``` ```bash node tools/clis/firecrawl.js map [prospect-url] ``` ```bash node tools/clis/exa.js search "[company name] funding" --num-results 5 ``` ```bash node tools/clis/exa.js search "[company name] news 2025 2026" --num-results 5 ``` ```bash node tools/clis/exa.js search "[company name] technology stack" --num-results 5 ``` ```bash node tools/clis/exa.js search "[company name] reviews" --num-results 5 ``` ```bash node tools/clis/exa.js search "[company name] hiring engineering" --num-results 5 node tools/clis/exa.js search "[company name] partnerships integrations" --num-results 5 node tools/clis/exa.js search "[company name] CEO interview" --num-results 5 ``` ### Technical Analysis The Skill instructs the agent to collect a prospect URL and company name from the user and interpolate those values into command-line templates. It does not require URL validation, shell-metacharacter rejection, argument escaping, or execution through a structured argument array. The URL placeholder is unquoted. If the resulting command is interpreted by a shell, a malicious URL containing command separators, redirection operators, pipelines, or command substitutions could alter the intended command and execute additional commands. The company name is enclosed in double quotes, but double quoting alone does not prevent all shell evaluation. In common shells, constructs such as command substitution remain active inside double-quoted strings. Consequently, a cr ...[truncated 1805 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. **Use structured process execution** - Invoke Node.js directly through an API that accepts an executable and an argument array. - Pass the prospect URL or company name as a discrete argument. - Do not assemble a shell command string from user-controlled content. - Disable shell execution explicitly where the process API supports that option. 2. **Validate prospect URLs** - Parse each value with a standards-compliant URL parser. - Permit only the `http:` and `https:` schemes. - Reject credentials embedded in URLs, control characters, malformed hosts, and unexpected whitespace. - Construct paths such as `/about` with a URL API rather than string concatenation. 3. **Constrain company-name input** - Reject control characters and line breaks. - Apply a reasonable length limit. - Treat the entire company name as inert data and never evaluate it as shell syntax. 4. **Add explicit security instructions to the Skill** - State that placeholders must never be substituted into shell command strings. - Require safe argument-array execution for all Firecrawl and Exa calls. - Warn that quoting alone is not a sufficient defense against shell command substitution. 5. **Apply least privilege** - Run research tooling in a sandbox with narrowly scoped filesystem access. - Expose only the credentials required for Firecrawl and Exa. - Restrict unnecessary outbound network access and prevent access to unrelated project secrets. 6. **Add adversarial tests** - Test URLs and company names containing command separators, pipes, redirects, quotes, line breaks, and command-substitution syntax. - Confirm that each payload reaches the CLI as one literal argument and is never evaluated by a shell. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill description contains very broad trigger phrases such as 'learn about a company,' 'what does this company do,' and 'company deep dive,' which can match many ordinary business requests and cause the agent to invoke this skill unexpectedly. Because the skill performs website scraping and external searches, over-broad routing can lead to unintended data collection, unnecessary third-party disclosure of user-provided targets, and actions beyond what the user explicitly requested.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to scrape a prospect website and perform external web searches without any explicit warning, consent check, or notice that company names and URLs may be sent to third-party tools. This creates a privacy and data-governance risk because users may provide sensitive prospect lists, internal targets, or non-public context, and the skill defaults into transmitting that information externally.

Static analysis

No suspicious patterns detected.