ClawHub
Back to skill

Security audit

Customer Churn Prediction Analyst

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate churn-analysis purpose, but it asks for broad customer/payment data access and has unclear third-party data handling and automation boundaries.

Review this skill before installing in a production workspace. Use scoped or test API keys where possible, confirm what customer data may be sent to OpenAI, Slack, or custom SaaS endpoints, and avoid enabling scheduled runs until notification contents, storage, and approval workflows are clear.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
API_KEY"],"bins":["python3","curl"]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"📊"}}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
# SaaS/custom platform
export SAAS_API_KEY="your_saas_api_key"
export SAAS_API_ENDPOINT="https://api.yourplatform.com/v1"

# OpenAI (for recommendation generation)
export OPENAI_API_KEY="sk-..."

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation creates a safety guarantee that the skill will not use deceptive urgency, but the example campaign includes scarcity-style language such as 'Last chance' and an expiration-based pressure tactic. This inconsistency can lead operators to trust the guardrails while deploying messaging that may violate the stated policy, brand standards, or consumer-protection rules.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill claims it only generates recommendations requiring explicit approval, yet other sections describe automated Slack notifications, scheduling, and intervention deployment tracking in a way that implies operational automation. This can mislead users about the degree of autonomous action and cause unintended disclosure of customer risk data or execution of retention workflows without adequate review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.