ClawHub
Back to skill

Security audit

cold-email-writer

Security checks for vulnerabilities and agentic risk

Overview

The skill promises email compliance checks, but its checker reports no problems even for an empty draft.

Use this only as a drafting aid until the checker is corrected; do not treat 'No flags' as approval to send. Independently review drafts against the [FTC compliance guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business). The optional Windows application requires a separate trust decision.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

If the reported implementation defects are accurate, the linter can fail to flag missing compliance elements while users rely on its results to approve commercial email. The compliance-focused description makes this false assurance consequential, potentially causing unlawful outreach and sender-reputation damage, although manual sending limits immediate impact; the script itself was not supplied, so the implementation claims remain independently unverified.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_write.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The compliance checker does not flag missing mandatory email elements despite the manifest promising CAN-SPAM checks.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The checker only searches for literal pattern strings and never checks whether mandatory elements are absent, so a draft without a postal address or opt-out mechanism can receive a misleading 'No flags' report. Using substring matching instead of regular-expression evaluation also prevents the configured patterns from detecting ordinary text. This is particularly consequential for a skill advertised as checking CAN-SPAM compliance before sending, although the lack of automatic sending and the human review step limit the immediate impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.