ClawHub
Back to skill

Security audit

LeadMagic

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed LeadMagic connector wrapper for lookup and enrichment actions, with no artifact-backed evidence of hidden or destructive behavior.

Install this if you intend to let your agent use LeadMagic through OOMOL. Be aware that the skill can request business and personal lead data such as work emails and mobile numbers, and review the oo CLI install command and OOMOL account connection before first use.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
85% confidence
Finding
The skill’s activation guidance is overly broad: 'Use this skill for ANY LeadMagic request' can cause the agent to route all LeadMagic-related tasks through this skill without evaluating whether the task is appropriate, necessary, or within least-privilege boundaries. In this specific file the listed actions are read-oriented and no dangerous write/destructive actions are exposed, so the main risk is misrouting, overuse of external data access, and reduced human review rather than direct system compromise.

Static analysis

No suspicious patterns detected.