ClawHub
Back to skill

Security audit

Cold Email Sequence

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only cold email writing skill whose behavior is disclosed and limited to generating outreach copy.

Before using this skill, make sure any prospect data is lawfully obtained, avoid purchased or scraped lists, honor unsubscribe and opt-out requirements, and comply with applicable anti-spam and privacy rules. Review generated emails before sending, since the skill drafts outreach copy but does not itself send messages.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly supports personalized cold outreach using prospect names, employers, and trigger events such as funding rounds, hiring activity, and competitor launches, but provides no guidance on lawful sourcing, consent, privacy compliance, or responsible handling of personal/business data. In a sales automation context, this omission can facilitate privacy-invasive profiling and outreach that may violate internal policy or applicable anti-spam/data protection requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.