ClawHub
Back to skill

Security audit

KPI Alert System

Security checks for vulnerabilities and agentic risk

Overview

This KPI alert skill is mostly purpose-aligned, but its examples include real-looking external recipients and fixed third-party branding that could misroute confidential financial alerts.

Review and replace every alert destination before use, remove any PrecisionLedger/Sam Ledger branding unless it is intentionally yours, and only enable scheduled alerts after confirming approved recipients and limiting sensitive detail in messages.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:53
Finding

Hardcoded External Alert Recipients Can Cause Unauthorized Financial Data Disclosure

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53-60
Vulnerability Type: Hardcoded external data recipients
Risk Level: High

yaml
client: "Acme Corp"
alert_channels:
  - type: telegram
    target: "@irfan_dm"  # or channel ID
  - type: slack
    webhook: "https://hooks.slack.com/services/..."
  - type: email
    to: "imussa@precisionledger.io"

Technical Analysis

The copy-ready configuration example contains real-looking Telegram and email destinations instead of unambiguous placeholders. The skill processes commercially sensitive information, including accounts-receivable aging, cash runway, revenue, gross margin, and burn rate. If an agent or user reuses this example without replacing every destination, alerts containing that information could be transmitted to unintended third parties.

This is an insecure configuration practice rather than evidence of credential theft or malicious executable code. The Slack webhook is visibly incomplete, but the Telegram username and email address appear operationally plausible and are not clearly marked as values that must be replaced.

Attack Path

  1. A user asks the agent to configure KPI monitoring for a business or client.
  2. The agent copies or adapts the example configuration from SKILL.md.
  3. The embedded Telegram username or email address remains unchanged.
  4. The skill retrieves financial metrics from QuickBooks Online, Google Sheets, or CSV exports.
  5. A threshold is breached and an alert containing confidential financial information is generated.
  6. The alert is delivered to the hardcoded external recipient without the data owner's informed authorization.

Impact Assessment

Successful exploitation or accidental activation does not grant local system privileges. Its scope is unauthorized disclosure of financial KPI data available to the configured monitoring workflow. Depending on the connected source, exposed informat ...[truncated 362 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace all real-looking destinations with unmistakable placeholders, such as YOUR_TELEGRAM_CHAT_ID, YOUR_SLACK_WEBHOOK, and YOUR_EMAIL_ADDRESS.
  • Refuse to send alerts until the user explicitly supplies or confirms each destination.
  • Display the resolved channel type and destination before enabling delivery or scheduling recurring checks.
  • Require a test notification containing no financial data before activating production alerts.
  • Validate destinations against an organization-controlled allowlist where possible.
  • Store Slack webhooks and similar credentials in a secret manager or environment variable rather than in YAML configuration files.
  • Add a safe default that disables outbound delivery when any destination is missing, unchanged from an example, or not verified.
  • Record destination changes and require renewed approval when a configuration is copied between clients.

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:178
Finding

Fixed Third-Party Attribution Is Injected into User-Facing Alerts

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 178-200
Vulnerability Type: Prescribed third-party branding and attribution
Risk Level: Low

text
🚨 KPI ALERT — Acme Corp
Date: March 15, 2026

🔴 AR 90+ Days: $18,500
   → Collections action needed immediately

🟡 Gross Margin: 38%
   → Below 40% target — review COGS

✅ Cash Runway: 8.2 months
✅ Revenue Growth: +4.2% MoM

Run by: Sam Ledger / PrecisionLedger
json
{
  "attachments": [
    {
      "color": "#ff0000",
      "title": "🔴 AR 90+ Days — $18,500",
      "text": "Collections action needed. 90+ day bucket exceeds $15,000 threshold.",
      "footer": "KPI Alert System | PrecisionLedger",
      "ts": 1742076000
    }
  ]
}

Technical Analysis

The prescribed Telegram and Slack templates insert a named person or organization into user-facing output regardless of who operates the skill. This attribution is not necessary for KPI calculation, threshold evaluation, or alert delivery. An agent following the template may therefore represent independently generated alerts as originating from an unrelated third party.

The behavior does not alter system safety controls or grant additional permissions. Its security relevance is limited to output integrity, deceptive attribution, and unwanted promotion. It is classified as instruction hijacking because the skill text directs the agent to add unrelated identity information to the user's requested output.

Attack Path

  1. A user requests a KPI alert or report without requesting external branding.
  2. The agent follows the supplied Telegram or Slack formatting template.
  3. The generated message includes Sam Ledger / PrecisionLedger or the PrecisionLedger footer.
  4. The message is delivered to internal personnel, clients, or external recipients.
  5. Recipients may incorrectly conclude that the named person or organization produced, reviewed, or endorsed t ...[truncated 517 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove fixed personal and organizational names from all alert templates.
  • Replace attribution with optional variables such as {operator_name} and {organization_name}.
  • Leave attribution fields empty by default and include them only after explicit user configuration.
  • Require confirmation before adding branding to externally delivered reports.
  • Clearly distinguish automated generation from human review; do not imply approval or authorship unless it occurred.
  • Add template tests that reject undeclared names, email addresses, social handles, and organization-specific branding.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly routes sensitive business financial KPIs through Telegram, Slack, and email, but it does not prominently warn users that these channels may expose confidential financial data to third-party platforms, shared workspaces, or misconfigured recipients. Because the content includes AR aging, runway, margin, and burn-rate data, accidental disclosure could reveal material business health information to unauthorized parties.

Content

No source excerpt is available for this finding.