ClawHub
Back to skill

Security audit

Leadgenius

Security checks across malware telemetry and agentic risk

Overview

This lead-enrichment skill is purpose-aligned but needs review because it can update CRM records and send prospect data to multiple services at scale without clear approval or rollback controls.

Review before installing. Use sandbox or least-privilege CRM and enrichment tokens, avoid pasting production secrets into chat or committed files, start with a small dry run, require a preview before any CRM/Sheets/Slack/Zapier export, and verify privacy, retention, and compliance claims before processing customer or regulated data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill includes realistic-looking API keys, org IDs, webhook URLs, and other secret-bearing configuration examples without a prominent warning not to paste real production credentials into prompts, logs, or shared files. In an agent setting, this can normalize unsafe secret handling and lead to accidental disclosure of credentials to the model, external tools, or other connected systems.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The overview advertises automatic CRM syncs and direct profile pushes to external systems without an upfront warning that the skill can modify records in connected CRMs. That omission increases the chance a user triggers unintended writes, overwrites, or bulk updates to production sales data without understanding the side effects.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.