ClawHub
Back to skill

Security audit

cold-email

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed SkillBoss API integration for generating cold emails, but users should understand that lead contact data is sent to SkillBoss for processing.

Install only if you are comfortable sending lead records, email addresses, LinkedIn URLs, company context, signatures, and campaign details to SkillBoss. Use consented or approved lead data, avoid unnecessary sensitive fields, and review generated emails before any automated campaign use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
SKILL.md:119
Finding

Unnecessary Third-Party Disclosure of Lead Personal Data

Content
View full analysis
dict: r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() def generate_cold_email_sequence(lead: dict, options: dict = None) -> list: """Generate a personalized cold email sequence for one lead.""" if options is None: options = {} email_count = options.get("email_count", 3) signature = options.get("email_signature", "") angle = options.get("campaign_angle", "") ctas = options.get("approved_ctas", []) user_content = ( f"Generate a cold email sequence for this lead:\n\n" f"Name: {lead.get('name', '')}\n" f"Title: {lead.get('title', '')}\n" f"Company: {lead.get('company', '')}\n" f"Email: {lead.get('email', '')}\n" f"Company Website: {lead.get('company_website', '')}\n" f"LinkedIn: {lead.get('linkedin_url', '')}\n\n" f"Options:\n" f"- Number of emails: {email_count}\n" f"- Signature: {signature}\n" f"- Campaign angle: {angle}\n" f"- CTAs to use: {ctas}\n\n" f'Return JSON: {{"sequence": [{{"step": 1, "subject": "...", "body": "..."}}, ...]}}' ) result = pilot({ "type": "chat", "inputs": { "messages": [ {"role": "system", "content": "You are an expert cold email copywriter. Generate personalized cold email sequences based on lead data. Each email should be unique, relevant, and high-converting. Return a JSON object with a 'sequence' array."}, {"role": "user", "content": user_ ...[truncated 2571 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:143
Finding

Prompt Injection Through Untrusted Lead and Campaign Fields

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The documentation states that the skill sends lead context to an external API which may research and process company, title, website, and LinkedIn data. While this is part of the advertised functionality, it is still a genuine security/privacy concern because users may not appreciate that third-party processing occurs and that customer/prospect data leaves the local environment.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
## How It Works

This skill calls the SkillBoss API Hub (`POST https://api.skillbossai.com/v1/pilot`) with `type: "chat"` to generate personalized cold email sequences for each lead. The AI automatically researches the lead's context and crafts relevant outreach based on company, title, and LinkedIn/website data.

## Endpoints

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill clearly sends lead data, including email addresses and potentially LinkedIn/profile data, to a third-party API for AI processing, but the documentation does not prominently warn users that personally identifiable information is being transmitted off-platform. This creates privacy, compliance, and consent risks because operators may unknowingly submit regulated or sensitive prospect data to an external processor.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

All requests go to the SkillBoss API Hub unified endpoint:

text
POST https://api.skillbossai.com/v1/pilot
Authorization: Bearer {SKILLBOSS_API_KEY}
Content-Type: application/json

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

All requests go to the SkillBoss API Hub unified endpoint:

text
POST https://api.skillbossai.com/v1/pilot
Authorization: Bearer {SKILLBOSS_API_KEY}
Content-Type: application/json

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The code performs an outbound HTTPS POST to a third-party service and includes lead data in the JSON body, which constitutes external transmission of potentially sensitive business contact and profile information. In this skill's context, that behavior is expected for functionality, but it remains security-relevant because users may expose PII, proprietary lead lists, or prompt content to an external processor.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
API_BASE = "https://api.skillbossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

Most of the file is written in English, but the response-format table switches to Chinese labels (能力, 结果路径) without explanation or user opt-in. This creates an implicit language/locale inconsistency that may violate organizational language policy when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.