ClawHub
Back to skill

Security audit

Afrexai Business Automation TEMP

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only business automation skill, but it needs review because some templates allow financial workflows to auto-approve or schedule payments without enough explicit safeguards.

Review this skill before installing for production use. It is not malware based on the inspected artifacts, but any workflows created from it should default to dry-run, use least-privilege credentials, require explicit human approval for payments or public/customer-facing actions, and treat timeouts as escalation or stop conditions rather than approval.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This markdown file presents the skill as able to implement business automations and use agent tools such as cron jobs, APIs, scripts, and notifications. Those behaviors can modify systems or transmit data, but the description does not include any user-facing warning about reviewing actions before execution or validating data/privacy implications.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly guides users to implement automations that can send messages, modify systems, process invoices, and trigger payments, but it does not present an upfront safety warning about production impact, privacy, consent, or the need for dry-run/testing before acting on real systems. In a business automation skill, this omission increases the risk that a user will operationalize high-impact workflows against live data or financial systems without adequate safeguards.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
→ Extract data (vendor, amount, line items, due date)
  → Match to PO / budget category
  → Validate:
    - Amount within approved range? → Auto-approve
    - Over threshold? → Route to manager
    - No matching PO? → Flag for review
  → Schedule payment based on terms
Confidence
93% confidence
Finding
The invoice workflow recommends automatic approval when an amount is within a predefined range, followed by scheduled payment, without requiring strong controls such as verified vendor identity, PO integrity checks, fraud screening, or explicit human approval thresholds based on business risk. In a financial workflow, autonomous approval can enable erroneous or fraudulent payments at scale if upstream data is incorrect or manipulated.

External Transmission

Medium
Category
Data Exfiltration
Content
# Step 1: Fetch data
log "Fetching data from [source]..."
DATA=$(curl -s -H "Authorization: Bearer $API_TOKEN" \
  "https://api.example.com/endpoint")

# Step 2: Validate
if [ -z "$DATA" ]; then
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
on_reject: "notify_requestor_with_reason"
  on_timeout:
    - Escalate to next level
    - Or: auto-approve if amount < $10000
```

### Graceful Degradation
Confidence
90% confidence
Finding
The approval-gate design allows timeout-based auto-approval for transactions under $10,000, which weakens the purpose of the approval control and creates a failure mode where inaction becomes authorization. An attacker or simple notification failure could exploit this by ensuring approvers do not respond, causing unauthorized spending or changes to proceed automatically.

Static analysis

No suspicious patterns detected.