Prospector Lite — B2B Outreach Framework

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:29 AM UTC
• Version: 2.0.0

Overview

This skill is a disclosed B2B outreach workflow, but it enables recurring inbox access and outbound cold email with weak consent and dependency scoping.

Review this carefully before installing. Use it only with a dedicated email account or narrowly scoped email tool, verify the email integration's publisher and permissions, and require manual approval before the agent reads inbox content, enables the cron, or sends any external outreach.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned and Ambiguous Email Tool Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- **gog** (Gmail CLI) — `openclaw skills install gog` or npm

Technical Analysis

The skill recommends installing the gog email tool without specifying an exact package version, authoritative registry URL, integrity hash, or verified publisher. The alternative instruction, “or npm,” is particularly ambiguous because it does not provide an exact npm package identifier.

This creates a software supply-chain risk involving dependency confusion, package-name ambiguity, typosquatting, or compromise of an unpinned upstream release. Because the suggested tool is expected to access Gmail and send outbound messages, a substituted or compromised dependency could execute with access to sensitive correspondence and email authorization credentials.

No evidence establishes that the referenced package is currently malicious. The vulnerability is the unsafe and insufficiently constrained installation guidance.

Attack Path

1. An attacker publishes a malicious or typosquatted package matching the ambiguous gog name, or compromises a later unpinned release.
2. A user or agent follows the instruction in SKILL.md and installs the package without validating its publisher, source, version, or integrity.
3. The package executes during installation or when invoked as an email tool.
4. The malicious package accesses locally available email credentials, authorization tokens, inbox content, prospect records, or outbound message data.
5. It may exfiltrate that information, modify recipients or message bodies, or send unauthorized email under the user's identity.

Impact Assessment

Successful exploitation could grant the malicious dependency the same effective privileges as the process running the email tool. Depending on the user's configuration, this co ...[truncated 537 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the ambiguous installation instruction with the exact official package identifier and authoritative registry or repository URL.
• Pin the dependency to a specific reviewed version rather than accepting the latest release.
• Provide and verify a cryptographic integrity hash or signed release artifact where supported.
• Identify the expected publisher or maintainer so users can detect typosquatted packages.
• Require review of package provenance, installation scripts, release signatures, and requested OAuth or SMTP permissions before use.
• Grant only the minimum email scopes needed for the workflow, and avoid broad mailbox or account-management permissions.
• Run the email integration in a restricted environment with limited filesystem and network access where practical.
• Establish an explicit dependency-update review process before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger text is overly broad and can activate on generic requests like research, lead generation, or contacting potential customers, causing the agent to enter a cold-outreach workflow when the user may not have intended external communications. In this skill context, that is more dangerous because the workflow includes prospect research, inbox access, and email sending, so mistaken activation can lead to privacy-impacting actions or unsolicited outreach.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to check inbox contents, process replies and bounces, and send outreach emails, but it does not require an explicit user warning or consent step before accessing communications data or contacting third parties. In this context, the missing consent and disclosure are risky because the skill is designed for autonomous recurring outreach, which amplifies privacy, compliance, and unintended-action risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.