ClawHub
Back to skill

Security audit

Company Enrichment

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed company-enrichment integration that sends company identifiers to Veezee, with a supply-chain caution around its optional unpinned npm setup command.

Before installing, confirm you are comfortable sending company lists, domains, LinkedIn URLs, and a Veezee API key to Veezee. Avoid using the optional npx setup in sensitive environments unless you pin and review the package version; use the narrower LinkedIn MCP endpoint rather than broader tooling when possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Package Execution via npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Unpinned and immediately executed third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown
The `veezee` CLI (`npx @veezee/sdk init`) mints and stores the same key.

Technical Analysis

The documented npx @veezee/sdk init command resolves and executes a third-party npm package without specifying a reviewed version or verifying its integrity. If the package is not already installed locally, npx can download its currently published version and immediately run its CLI code, including applicable package or dependency lifecycle behavior.

Because package resolution is mutable, the code executed when a user follows this instruction may differ from the code available when the Skill was audited. Exploitation would require compromise or malicious publication within @veezee/sdk or its transitive dependency chain. The project contains no evidence that the package is presently malicious; the finding concerns unsafe supply-chain execution.

Attack Path

  1. An attacker compromises the npm package, a maintainer account, the publication process, or a transitive dependency.
  2. The attacker publishes a malicious version that satisfies the unpinned package reference.
  3. A user follows the Skill's setup instructions and runs npx @veezee/sdk init.
  4. npx resolves and downloads the attacker-controlled package version.
  5. The malicious CLI or package code executes with the permissions of the invoking user.

Impact Assessment

Successful exploitation could execute arbitrary code with the invoking user's privileges. Depending on the environment and available permissions, this could expose local files, environment variables, credentials, API keys, and source code; alter user-owned files; make network requests; or install additional malicious components. The immediate scope is the user account or container runn ...[truncated 131 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a specifically reviewed version, for example npx @veezee/sdk@<reviewed-version> init, rather than resolving the latest available release.
  2. Commit a package manifest and lockfile where practical, and use deterministic installation such as npm ci.
  3. Verify package provenance, publisher identity, signatures or attestations, and registry integrity metadata before execution.
  4. Review the pinned package and its transitive dependencies, and use automated dependency and malware scanning.
  5. Run initialization in a restricted environment with minimal filesystem access, no unnecessary secrets, and limited network permissions.
  6. Document the expected package version and integrity hash so users can detect unexpected upstream changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description says to use the skill when the user wants to "enrich, look up, or research a batch of companies." Phrases like "look up" and "research" are broad and could match many ordinary requests unless more explicit trigger boundaries or exclusion conditions are provided.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The skill directs the agent to transmit company identifiers and authentication material to external services (api.veezee.io and MCP endpoints). Even if this is the stated purpose of the skill, it creates a real data exfiltration boundary: user-supplied company lists, domains, LinkedIn URLs, and potentially API keys leave the local environment and are sent to a third party.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
Every call needs an API key. Minting one is free and human-free: no signup, no card. A call without a key fails with `KEY_REQUIRED` (401) carrying `mint_url`; the fix is the free mint below, never a payment. A fresh `vz_trial_` key runs under a free per-IP daily budget of 200 credits, cached data only, first page only on any cursor sequence. Two equivalent surfaces; pick whichever your environment has:

- MCP: add the server `https://mcp.veezee.io/linkedin` (streamable-http; `https://mcp.veezee.io/all` exposes every tool). Hosts that support MCP authorization (Claude Code, claude.ai) open a Veezee sign-in on connect (email code, no password): that is the whole auth step. Other hosts: mint a key with `POST https://api.veezee.io/v1/keys/mint` (empty body; the key is shown once) and put it in the connection's `Authorization: Bearer` header.
- SDK: `import { VeezeeClient } from "@veezee/sdk"`; `const client = new VeezeeClient(); await client.mint();` mints and stores the free key the first time and reuses it on later runs. Platform methods live on the namespace (`client.linkedin.getProfile/searchPeople/getCompany/getPosts`); `client.resolveUrl` and `client.getUsage` are top-level. The client sends retries and Idempotency-Keys for you. The `veezee` CLI (`npx @veezee/sdk init`) mints and stores the same key.

The free daily budget covers only a handful of companies, so a real batch needs purchased credits. When the budget or a trial cap runs out (`TRIAL_CAP_EXCEEDED`, `INSUFFICIENT_CREDITS`, `BUDGET_EXHAUSTED`), the error carries `upgrade_url` (https://veezee.io/upgrade) and a machine-readable `offer`; hand that link to your human, and purchases credit the same key directly, nothing to reconfigure.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.