ClawHub
Back to skill

Security audit

Account Research

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward account-research guide that uses Veezee and LinkedIn data, with the main caution being third-party API use and an optional unpinned SDK command.

Before installing, make sure you are comfortable sending account-research queries and usage metadata to Veezee. Use the LinkedIn-scoped MCP endpoint rather than the all-tools endpoint, set max_credits, and avoid running the unpinned npx command unless you have reviewed or pinned the SDK version and know where the API key will be stored.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Package Execution via npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Unpinned and immediately executed third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown
The `veezee` CLI (`npx @veezee/sdk init`) mints and stores the same key.

Technical Analysis

The setup documentation instructs the user or agent to execute npx @veezee/sdk init without specifying an exact package version, lockfile, or integrity hash. If the package is not already available locally, npx can retrieve it from the configured npm registry and immediately execute its CLI code.

Because package resolution is not pinned to a reviewed release, the code executed during setup can change after the Skill has been audited. A compromised npm publisher account, package distribution channel, or later malicious release could therefore introduce arbitrary executable behavior. Package lifecycle scripts and the CLI entry point may run with the same operating-system permissions and environment access as the invoking user or agent.

Attack Path

  1. An attacker compromises the @veezee/sdk publisher account, package repository, or release process.
  2. The attacker publishes a malicious package version under the same package name.
  3. A user or agent follows the Skill's setup instruction and runs npx @veezee/sdk init.
  4. npx resolves and downloads the current package version because no exact version or integrity constraint is supplied.
  5. The malicious package code executes with the privileges of the invoking process.
  6. That code could access files, environment variables, locally available credentials, or network resources permitted to the user.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the invoking user's privileges. The accessible scope may include project files, user-writable files, environment variables, stored API credentials, and network services ...[truncated 218 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to a specific reviewed version, for example npx @veezee/sdk@<audited-exact-version> init, rather than resolving the latest release.
  • Commit and enforce a package lockfile when integrating the SDK into a project.
  • Verify package provenance and registry integrity metadata before execution.
  • Prefer installing the reviewed dependency without running lifecycle scripts, inspecting it, and then invoking the trusted local binary.
  • Run initialization in a sandbox or least-privilege environment with restricted filesystem, credential, and network access.
  • Document where the minted API key is stored and require restrictive file permissions for that credential.
  • Establish a dependency-update review process so version changes are explicitly audited before execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says to use the skill when the user wants to research an account, prepare for a call, or "get up to speed" on a single target company. The phrase "get up to speed" is broad everyday language and could overlap with many general requests, increasing the chance of unintended invocation without clearer constraints or negative examples.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill directs the agent to connect to external services (mcp.veezee.io, api.veezee.io) and place a bearer token in requests. External transmission is expected for this skill's function, but it still expands the trust boundary: company research queries, usage patterns, and API credentials are sent to a third party, so misuse, leakage, or over-collection could expose sensitive business context.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
Every call needs an API key. Minting one is free and human-free: no signup, no card. A call without a key fails with `KEY_REQUIRED` (401) carrying `mint_url`; the fix is the free mint below, never a payment. A fresh `vz_trial_` key runs under a free per-IP daily budget of 200 credits, cached data only, first page only on any cursor sequence. Two equivalent surfaces; pick whichever your environment has:

- MCP: add the server `https://mcp.veezee.io/linkedin` (streamable-http; `https://mcp.veezee.io/all` exposes every tool). Hosts that support MCP authorization (Claude Code, claude.ai) open a Veezee sign-in on connect (email code, no password): that is the whole auth step. Other hosts: mint a key with `POST https://api.veezee.io/v1/keys/mint` (empty body; the key is shown once) and put it in the connection's `Authorization: Bearer` header.
- SDK: `import { VeezeeClient } from "@veezee/sdk"`; `const client = new VeezeeClient(); await client.mint();` mints and stores the free key the first time and reuses it on later runs. Platform methods live on the namespace (`client.linkedin.getProfile/searchPeople/getCompany/getPosts`); `client.resolveUrl` and `client.getUsage` are top-level. The client sends retries and Idempotency-Keys for you. The `veezee` CLI (`npx @veezee/sdk init`) mints and stores the same key.

A full account briefing (company, posts, several people) spends more than the free daily budget, so this workflow needs purchased credits. When the budget or a trial cap runs out (`TRIAL_CAP_EXCEEDED`, `INSUFFICIENT_CREDITS`, `BUDGET_EXHAUSTED`), the error carries `upgrade_url` (https://veezee.io/upgrade) and a machine-readable `offer`; hand that link to your human, and purchases credit the same key directly, nothing to reconfigure.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The skill instructs users to run npx @veezee/sdk init without pinning an exact package version or integrity. That creates a supply-chain risk: future package updates or a compromised publisher account could cause different code to execute at runtime, potentially minting or exfiltrating credentials or altering behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.