ClawHub
Back to skill

Security audit

Data Enrichment

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent B2B lead-enrichment skill with no executable code, though users should apply privacy and lawful-use limits when enriching contacts.

Install only for legitimate business lead-enrichment workflows. Before using it with contact data, confirm you have a lawful basis to process that data, collect only fields you need, respect source terms such as LinkedIn's, avoid sensitive personal data, and verify records before importing them into a CRM.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly promotes contact discovery, social-profile enrichment, and collection of firmographic and technographic data, but provides no privacy, consent, or lawful-use guidance. In a lead-enrichment context, this omission can encourage users to process personal data without appropriate notice, legal basis, retention limits, or compliance checks, increasing risk of privacy violations and misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly asks users to paste contact lists and enrich personal/profile data from public sources, but it provides no privacy warning, lawful-use guidance, or handling limitations for personal data. This increases the risk of collecting, combining, and exporting personal information into CRMs without user awareness of consent, data minimization, retention, or jurisdictional privacy obligations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.