Outclaw Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:11 AM UTC
• Version: 1.0.6

Overview

This B2B research skill is coherent, but it broadly searches private communications and persistently stores enriched personal profiles without clear consent or retention controls.

Install only if you are comfortable with this skill reading connected inboxes, chats, SMS, notes, LinkedIn messages, public web sources, and Leadbay data for outreach research, then storing enriched profiles in the OutClaw KB. Limit connected private-source tools, require explicit approval before private-source searches or OCR, review KB/raw data regularly, and avoid using it for targets where you lack a legitimate outreach basis.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:282

Finding

Unrestricted Reconnaissance Across Private Communication Channels

Content

View full analysis

OR to:" --max 50 -j` | | `email-mcp` | same search via the MCP's search endpoint | | `slack-mcp-server` / `slack` | `slack search --user --max 50` | | `whatsapp-mcp-ts` / `wacli` | search conversation history by phone | | `telegram-mcp` | search chats where counterparty matches handle | | `mac_messages_mcp` / `imsg` | iMessage/SMS history by phone or contact | | `discord-mcp` | DM history by user id | | `linkedin-cli` | InMail / message history with the profile URL | | `apple-notes` / `things-mac` | search for user's own prior notes about the target | For every match, record: - Date of last interaction - Direction (sent-by-user | received-from-target) - Channel - A one-line summary (don't paste the body — PII) Drop a `raw/` snippet if the thread is substantive: ``` ### Technical Analysis The skill instructs the Agent to query every available private communication source merely because the corresponding connector is present. The affected sources include email, workplace chat, WhatsApp, Telegram, SMS, Discord, LinkedIn messages, private notes, and task-management records. Availability of a connector does not establish that access to all of its data is authorized for a particular person-research task. The workflow contains no explicit per-source consent gate, tenant-boundary check, target authorization check, or least-privilege restric ...[truncated 1539 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:317

Finding

Persistent Aggregation of Sensitive Personal and Relationship Data Without Retention Controls

Content

View full analysis

--prompt "Transcribe this email signature verbatim. Return fields: name, title, company, phone, email, address, socials."` | | `image_generate` / multimodal fallback | pass the image bytes + the same prompt | | `openai-whisper-api` | audio only — not applicable | Write extracted fields onto the KB frontmatter via `kb_page.py upsert`. Never invent fields — if the OCR result is unclear, log a gap, don't guess. ``` ### Technical Analysis The workflow deliberately harvests and persistently correlates phone numbers, addresses, employment information, social profiles, communication history, relationship context, and inferred interests. It also directs the Agent to process inline signature images through an OCR-capable tool. Although the instructions prohibit fabrication and verbatim storage of complete email bodies, they do not provide: - A lawful-purpose or consent check. - Field-level data minimization. - A retention or automatic deletion period. - Encryption requirements for sensitive fields. - Access-control validation for the resulting knowledge base. - Controls governing transmission of signature images to an external OCR provide ...[truncated 1504 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:175

Finding

Lead PII Stored in a Predictable Shared Temporary File

Content

View full analysis

/dev/null | wc -l | tr -d ' ') BEFORE_PEOPLE=$(ls ~/.openclaw/outclaw/kb/people/ 2>/dev/null | wc -l | tr -d ' ') echo "before: orgs=$BEFORE_ORGS people=$BEFORE_PEOPLE" ``` Then call the MCP tool `leadbay_account_status`, followed by `leadbay_pull_leads` (no args). Save the pull response JSON to `/tmp/leadbay-pull.json` using your Write tool. ```bash # --- Block 2: Tier-1 persist + verification gate (MANDATORY) --- python3 ~/.openclaw/skills/outclaw/shared/scripts/leadbay_tier1_persist.py \ --from-file /tmp/leadbay-pull.json AFTER_ORGS=$(ls ~/.openclaw/outclaw/kb/orgs/ | wc -l | tr -d ' ') AFTER_PEOPLE=$(ls ~/.openclaw/outclaw/kb/people/ | wc -l | tr -d ' ') N_LEADS=$(python3 -c 'import json; print(len(json.load(open("/tmp/leadbay-pull.json")).get("leads",[])))') echo "after: orgs=$AFTER_ORGS (+$((AFTER_ORGS-BEFORE_ORGS))) people=$AFTER_PEOPLE (+$((AFTER_PEOPLE-BEFORE_PEOPLE))) / leads_pulled=$N_LEADS" ``` The repository's own playbook contradicts this flow at `references/research-playbook.md`, lines 136–137: ```markdown - Do not cache LeadClaw responses on disk outside the KB raw/ (they have PII and should live under the controlled KB layout, never `/tmp`). ``` ### Technical Analysis The skill stores a Leadbay response containing personal lead information at the fixed path `/tmp/leadbay-pull.json`. A predictable path in a shared temporary directory introduces several security problems: - Other local users or processes may be able to observe or read the file. - A pre-existing symbolic link may redirect the write if the writing mechanism follows links. - Another process may replace the file between its creation and use. - Concurrent runs may overwrite or consume each ot ...[truncated 1577 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:293

Finding

Shell Command Injection Through Unvalidated Target Email

Content

View full analysis

OR to:" --max 50 -j` | | `email-mcp` | same search via the MCP's search endpoint | ``` Related unsafe interpolation also appears at `SKILL.md`, line 262: ```bash python3 "$SHARED/scripts/domain_classifier.py" "" ``` ### Technical Analysis The target email originates from user input or external research and is interpolated into shell commands. The Gmail example places the email within a double-quoted shell argument. Double quotes do not prevent shell command substitution: constructs such as `$(command)` and backticks are still evaluated inside double quotes. No instruction requires strict email validation, shell-metacharacter rejection, or argument-array execution. A malicious value that terminates or abuses the quoted context can therefore alter the command or execute a nested command with the Agent's operating-system privileges. The classifier example also becomes unsafe if an implementation performs textual placeholder replacement. Although the email is shown in quotes, embedded quote characters or command substitutions can still affect shell parsing unless the value is passed as a discrete process argument without a shell. ### Attack Path 1. An attacker supplies a crafted target email or causes one to be imported from an external record. 2. The value contains shell syntax, such as command substitution or a closing quote followed by additional commands. 3. The Agent substitutes the value into the documented command string. 4. The command is evaluated by a shell. 5. The shell executes the injected operation before or alongside the intended Gmail search or domain-classification command. 6. Injected commands can re ...[truncated 894 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises persistent profiling and enrichment from multiple sources, including later instructions to ingest local conversation-derived information, without a clear user-facing warning about retention, scope, or privacy implications. Users may unknowingly trigger long-lived storage of sensitive personal and relationship data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match ordinary requests like 'who is ' or 'find ', which can cause unintended invocation of a highly invasive research-and-persistence workflow. Because this skill can access many tools and write persistent profiles, accidental activation materially increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The instruction to 'use every available tool' encourages indiscriminate capability use instead of least privilege. In this skill, that materially raises risk because the available tools may include email, chat, notes, OCR, and web tools, enabling unnecessary access to sensitive data and widening the blast radius of mistaken or abusive execution.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

---

Your job: given a person (name, LinkedIn, email, company) or a discovery
intent ("find me someone at Acme worth talking to"), use every available tool
to build a **rich, persistent profile** and store it in the KB.

Output quality bar: **≥3 concrete, recent (≤30 day) signals** per target +

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill explicitly instructs writing collected research into raw files, creating durable local retention of scraped personal and company data. Persistent storage increases exposure from later reuse, unauthorized access, and accumulation of outdated or excessive personal information.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

If `leadbay_*` isn't in your tool list, that's fine — use `web_search` to
find the target's LinkedIn/Twitter/company page, `web_fetch` the specific
pages, and write what you actually learn into `raw/<slug>-<ts>.md`.
**Never insist on a tool that isn't in your active tool list.** Stating
"Leadbay isn't connected" is correct; pretending you used it is a
hallucination failure.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md

`shared/references/leadbay-integration.md` for the full mental model.
Key rules:

1. **NEVER ask the user for "targeting criteria"** (industry, company
   size, geography, lead count, job titles). The user's ICP is already
   configured inside Leadbay. Asking for criteria = you're thinking of
   Leadbay as a DB, which it isn't.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

Saving the full Leadbay pull response to /tmp and then persisting it via scripts creates local copies of potentially sensitive lead and contact data outside the immediate session. Temporary and intermediate files are easy to overlook, broadening the chance of unintended retention or exposure.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

Then call the MCP tool leadbay_account_status, followed by leadbay_pull_leads (no args). Save the pull response JSON to /tmp/leadbay-pull.json using your Write tool.

bash

# --- Block 2: Tier-1 persist + verification gate (MANDATORY) ---

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs the agent to search across broad personal communication systems and notes stores, then persist summaries into a KB, far beyond what is necessary for outreach research. This creates a real risk of over-collection of sensitive personal data, cross-context leakage, and privacy violations if the target’s email/phone is supplied or inferred.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This instruction persists extracted signature fields such as phone, address, title, and social links into KB frontmatter, turning private communication artifacts into structured, reusable profile data. That conversion materially increases privacy risk and makes sensitive contact details easier to search, reuse, and exfiltrate later.

Content

Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.

md

| `image_generate` / multimodal fallback | pass the image bytes + the same prompt |
| `openai-whisper-api` | audio only — not applicable |

Write extracted fields onto the KB frontmatter via `kb_page.py upsert`.
Never invent fields — if the OCR result is unclear, log a gap, don't guess.

**c. People from the same company (if known).** If `company_slug` is

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 430)May include surrounding context.

text

If any file is missing, STOP. Do not proceed to return. Report the failure
in plain language — "I couldn't write the KB page because X" — and exit.
Do NOT continue to Step 5 with fake content.

### Step 5 — Return

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is explicitly designed to aggregate, infer, and persist sensitive personal data such as email, phone, address, prior conversations, social profiles, and relationship context into a knowledge base, but it contains no privacy guardrails, consent checks, data-minimization limits, or user-facing warning. In a B2B outreach context this materially increases the risk of unauthorized profiling, over-collection of personal data, and retention of sensitive information from local files and external sources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guidance tells the agent to derive a company from a corporate email domain and then create or update kb/orgs/<slug>.md and link the person to the org, but it does not require notifying the user that their persistent data store will be modified. In a research/enrichment skill that may process ambiguous or stale contact information, silent KB writes can create inaccurate records and durable privacy-sensitive associations without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The playbook explicitly instructs extracting phone numbers, addresses, titles, and OCR-transcribed signature data and writing them into persistent KB frontmatter without requiring user confirmation, minimization, or any privacy warning. Because this skill performs broad person/company research and stores outreach-relevant PII, it can silently persist sensitive contact data from emails and images into the user's knowledge base, increasing privacy, compliance, and misuse risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill expands scope to OCR/transcription of signature images to extract phone, address, socials, and employer details for storage in the KB. Even if technically useful, this is unnecessary by default for the declared purpose and increases collection of hidden or semi-structured PII from private communications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.