ClawHub
Back to skill

Security audit

Small Goods Loyalty Incentives

Security checks for vulnerabilities and agentic risk

Overview

This skill provides loyalty-program planning guidance with small local helper scripts, and its behavior is coherent with its stated purpose despite a few documentation and compliance caveats.

Before installing, treat the skill as planning guidance rather than a compliance review. Add your own consent, unsubscribe, and privacy checks before using email/SMS or birthday-based campaigns, and be careful when running helper scripts with --out because they can overwrite the chosen file.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The declared description promises a comprehensive loyalty-program design skill covering strategy, incentives, and validation planning for low-AOV/high-repeat commerce. The supplied code only implements a limited subset: generation of a simple markdown incentive calendar from a few boolean flags and a lapsed-days parameter. This is related to the declared domain, so it is not entirely unrelated, but the primary purpose is materially narrower than described. Key promised outputs—structured program design and measurable validation plans—are absent, and there is no logic for metrics, optimization, segmentation depth, or broader loyalty architecture.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared description promises a strategic loyalty-program design tool that should help create or refine programs, incentives, tiers, benefits, calendars, and measurement plans for DTC businesses. The supplied code does something much narrower: it loads a JSON config, checks presence and ranges of a handful of fields, computes reward cost as a percentage of revenue, compares that to margin, and emits a markdown findings report. While the code is loyalty-related, its primary purpose is configuration validation/sanity checking, not program design or strategic planning. This is a material description-behavior mismatch.

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The manifest description uses very broad trigger language such as general business goals and common retention terms, which can cause the skill to auto-activate in many loosely related contexts. Over-broad invocation increases the attack surface for prompt hijacking, misrouting, or inappropriate application of the skill in conversations where it is not actually relevant, especially in agentic systems that select skills automatically.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The playbook recommends SMS and email birthday/win-back outreach but does not mention obtaining valid marketing consent, honoring opt-outs, or handling personal data like birthdays in a privacy-compliant way. In a DTC loyalty context, this can lead operators to implement campaigns that violate privacy and anti-spam requirements, creating regulatory, reputational, and customer-trust risk.

Missing User Warnings

Low
Confidence
81% confidence
Finding
This code performs a file write when --out is provided, but it does not present a confirmation prompt, warning, or explicit user-facing notice at the point of the write. Although the CLI argument implies output behavior, the write can overwrite an existing file silently and there is no additional disclosure in comments or messaging.

Static analysis

No suspicious patterns detected.