T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:87- Finding
Mutable Remote Repository Is Retrieved and Installed Without Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Security audit
Lead Gen Website Pipeline
Security checks for vulnerabilities and agentic risk
Overview
This skill is disclosed as a sales automation tool, but it installs unpinned remote code and enables unattended cold outreach, deployment, and persistent credential use.
Review this skill carefully before installing. Use an isolated workspace or account, pin and audit the remote repository before running npm install, restrict API keys to the minimum permissions, avoid unattended sending until recipients and messages are approved, and add unsubscribe, suppression, rate-limit, and legal-compliance controls for any outreach.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T06 · System Persistence
Warning
- Location
SKILL.md:123- Finding
Persistent Unattended Polling and Outreach Execution
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly automates a 5-email cold outreach drip sequence and even provides scheduling guidance, but it does not warn users about consent, anti-spam, CAN-SPAM/GDPR/PECR, unsubscribe, or sender-identity obligations. In context, this omission is risky because the workflow is designed to scale unsolicited contact, increasing the chance of abusive or non-compliant campaigns.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill describes collecting, scraping, enriching, storing, and using business/contact data from Google Places, websites, reviews, Google Sheets, and outreach artifacts without clear data-handling warnings or minimization requirements. Because the pipeline centralizes and operationalizes contact data for prospecting, absent retention, access-control, and lawful-use guidance can enable privacy violations, oversharing, or mishandling of personal/business contact information.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description defines a broad end-to-end automation pipeline for discovering businesses, generating sites, deploying them, and conducting outreach without stating any user approval gates, target constraints, or compliance boundaries. In an agent skill, this kind of unconstrained activation scope can enable large-scale autonomous actions against third parties, increasing the risk of spam, unauthorized contact, and unintended external impact.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description explicitly mandates a 5-email cold outreach drip as part of the default pipeline, with no indication of user opt-in, recipient consent, or policy checks. This is dangerous because it normalizes automated unsolicited contact at scale, which can violate anti-spam rules, trigger abuse, and cause reputational or platform-level harm.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The document instructs users to download a long-lived Google Cloud service account JSON key and store it on disk under a predictable path in the local workspace. Persisted service account keys are highly sensitive credentials; if the workstation, repo, logs, backups, or workspace directory are exposed, an attacker could use the key to access and modify the linked Google Sheet with the granted Editor permissions.
- Content
md ## Service Account Access 1. Create a GCP project and enable the Sheets API 2. Create a service account and download the JSON key 3. Share your sheet with the service account email (Editor access) 4. Save the JSON key to `~/.openclaw/workspace/gcp-service-account.json`
Static analysis
No suspicious patterns detected.