ClawHub
Back to skill

Security audit

CRM Hygiene Cleanup

Security checks for vulnerabilities and agentic risk

Overview

The bundled script processes contacts locally and reports possible email duplicates, but does not provide the complete cleanup it advertises.

Keep the original contacts and treat the output as a preliminary duplicate report, not import-ready cleaned data. Blank emails and shared inboxes need manual review. Remove the template's initial comment lines before use, because they otherwise break CSV header parsing. The optional unsigned Windows app is unnecessary for this workflow and has not been assessed here.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The implementation is a narrow email-duplicate reporting tool rather than the declared contact-list cleanup workflow. Its unique-record collection is never exported, and its human-review guardrails are merely report text, not enforced logic. Blank emails and shared role addresses are treated as ordinary duplicate keys without review handling. No unrelated resource access or undeclared external capability is evident.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_write.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
- Never scrape personal emails to fill a gap in a record.
- Never merge two contacts that only share a role address such as info@ without a human check.
- Never delete a record silently; send it to the needs-review list with the reason.
- Never buy or import a list that has no consent record behind it.

## Quickstart

The skill reports duplicate email keys but does not produce the cleaned contacts or human-review records promised by its manifest.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The manifest promises name, phone, and email normalization, deduplication, and separation of records needing human review. At L091, normalization is applied only to an email comparison key; the original records remain unchanged, and L104 writes only a Markdown duplicate report rather than a cleaned contact list or a needs-review dataset. The guardrails printed at L101-L103 do not implement review routing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.