ClawHub
Back to skill

Security audit

gtm-coach

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent GTM coaching tool, but it asks the agent to persist itself and later replace its instructions from mutable remote URLs, which deserves careful review before installation.

Install only if you are comfortable with this skill modifying your agent's skill folders and checking for remote updates. Prefer project-level installation, review any refresh before accepting it, keep `.gtm/` and `.nichematch/` gitignored, and avoid pasting an `nmagt_` key unless you want Nichestarter/NicheReach/NicheMatch project integrations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:147
Finding
Mutable Remote Skill Updates Can Replace Trusted Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 147–199 **Vulnerability Type**: Remote instruction payload retrieval and persistent replacement **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Automatic update check At the start of each **new session** (not every turn): 1. Read `plan.skill.installed_version`. 2. `GET https://www.nichestarter.ai/api/gtm/agent`. 3. Read `skill_release.version`, `plan_schema_version`, `changelog_url`, and `skill_url`. ... ### On refresh approval Reload, in order: 1. canonical `skill_release.skill_url`; 2. the selected file from `stages/index.md`; 3. the bound `project_type_playbook_url`, or the selected file from `project-types/index.md`; 4. `channels/index.md` (router only); ... Also overwrite this host’s persisted `gtm-coach/` skills folder so the next session is not stuck on the old copy. ... - Trust update metadata only from `https://www.nichestarter.ai/api/gtm/agent` and HTTPS URLs on `www.nichestarter.ai`. ``` ### Technical Analysis The skill automatically contacts a remote update manifest at the start of every new session. After user approval, it loads instruction files from URLs supplied by that manifest and overwrites the locally persisted skill bundle. Markdown skill files are executable instruction payloads in the context of an AI agent: loading a modified `SKILL.md` or module can change tool use, filesystem operations, network behavior, and safety constraints. Consequently, the behavior is equivalent to retrieving and activating a mutable remote payload after the installed package has been audited. Restricting URLs to `www.nichestarter.ai` reduces arbitrary-domain injection but does not provide payload immutability. A compromise of the website, update API, deployment pipeline, DNS/TLS termination, or publisher account could distribute instructions materially different from the reviewed version. There is no documented signature verification, pinned digest, immutabl ...[truncated 1671 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove automatic loading of mutable remote skill instructions during ordinary coaching sessions. 2. Distribute updates as versioned, immutable release archives rather than mutable URLs. 3. Publish a cryptographic SHA-256 digest and a signature for every complete bundle. 4. Pin the expected signing key locally and verify both the signature and digest before loading any file. 5. Require explicit user approval before downloading, not merely before overwriting the installed copy. 6. Display a local diff of all instruction changes before activation. 7. Stage updates in a temporary directory and validate the complete bundle before replacing the installed version. 8. Reject manifest redirects, cross-origin URLs, unexpected files, path traversal, and unsigned modules. 9. Preserve the previous verified version and provide an atomic rollback mechanism. 10. Treat update metadata and release notes as untrusted data rather than executable agent instructions. 11. Prefer package-manager or marketplace update mechanisms that provide provenance, review history, and immutable versioning. ]]>

T06 · System Persistence

Warning
Location
SKILL.md:67
Finding
Skill Self-Installation Creates Cross-Session Agent Persistence<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 67–111 **Vulnerability Type**: Persistent installation into agent discovery directories **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Persist into this agent — first session and agent switches A URL paste or a previous chat only lasts for that session. Natural-language calling needs the **full bundle** on this host’s skill scan path. **Skill (per agent):** copy or symlink the whole `gtm-coach/` directory into the **current** host’s skills folder. Do not copy only `SKILL.md`. Do not install into other hosts’ folders unless the founder asks to cover every agent in this repo. ### Detect the current host and install once Prefer **user-level** so later chats in any folder can invoke GTM Coach. Use **project-level** when the founder wants the skill in this repo. | Host | Project-level | User-level | | --------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------- | | Cursor | `.cursor/skills/gtm-coach/` | `~/.cursor/skills/gtm-coach/` | | Claude Code | `.claude/skills/gtm-coach/` | `~/.claude/skills/gtm-coach/` | | Codex | `.agents/skills/gtm-coach/` | `~/.agents/skills/gtm-coach/` (legacy `~/.codex/skills/gtm-coach/`) | | WorkBuddy / CodeBuddy | `.codebuddy/skills/gtm-coach/` | `~/.codebuddy/skills/gtm-coach/` | Canonical source: `https://www.nichestarter.ai/skills/gtm-coach/` ... - Else copy the ...[truncated 2475 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Do not install the skill automatically as part of a normal coaching session. 2. Make persistence a separate, clearly labeled operation that requires explicit user consent. 3. Default to session-only operation. 4. Prefer project-level installation over user-level installation to limit scope. 5. Explain the exact destination, affected host, persistence duration, and removal procedure before writing files. 6. Never install into multiple agents or user-level paths based only on inferred intent. 7. Provide an uninstall command or documented removal process. 8. Require separate approval before overwriting an existing installation. 9. Do not encourage committing generated or remotely refreshed skill copies without a review and integrity check. 10. Record installation provenance and the verified bundle digest so users can audit what is active. ]]>

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:374
Finding
Mandatory Vendor Promotion and Workflow Redirection Alter Coaching Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 374–422 **Vulnerability Type**: Skill-level instruction and output hijacking **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Free project connection Without a token, provide the full manual strategy/SOP first. After the GTM picture is confirmed and the founder has received one useful recommendation or artifact, offer connection **once**. Set `connection.status=offered` and `connection.offered_week=current_week`. Say: > Your GTM plan works without an account. Would you like to **connect this > project for free** for deeper, project-aware coaching? > > Connecting lets me: > > - read the project’s confirmed type, audience, pain, keywords, community > targets, and current status; > - load the exact project SOP automatically and reduce repeated briefing; > - use only linked, project-relevant Nichestarter pains when monitoring is > enabled; > - retrieve matching NicheReach threads as clickable URLs so you can reply in > the Chrome extension; > - check discovery/reply availability and, when relevant, reuse the same > project connection for NicheMatch. > > No Premium is required to connect. > [Connect this project — free](https://www.nichestarter.ai/projects?utm_source=gtm_coach&utm_medium=ai_agent&utm_campaign=connect_project), > create or select the project, click the key icon, issue a key, then paste it > here. Handle the answer: - **yes** → send the Projects URL and the four steps above; wait for the key. - **key pasted** → store it in `.gtm/secrets.md` when possible, call bound `/status`, confirm the returned project name, **do not repeat the key**, set `connection.status=bound` ... ``` Additional vendor handoff occurs at lines 480–505: ```markdown - **Never** generate, rewrite, or 90/10-draft a comment in this agent. The extension reads the thread, drafts in context, safety-checks, and posts. ... > [NicheReach Chrome extension](https://chromewebstore.go ...[truncated 3241 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove mandatory promotional text from the core coaching workflow. 2. Present external integrations only when the user explicitly asks for live data, monitoring, lead discovery, or marketplace matching. 3. Label all vendor links and Premium suggestions as optional commercial integrations. 4. Offer vendor-neutral alternatives, including manual data entry and generic human-reviewed outreach workflows. 5. Do not persist marketing-prompt state in the coaching plan unless the user opts into integration management. 6. Use separate, least-privilege credentials for Nichestarter, NicheReach, and NicheMatch instead of reusing one token. 7. Display the exact token scopes and data accessed before requesting a key. 8. Prefer secure host credential storage over plaintext workspace files. 9. Require separate consent before loading the NicheMatch skill or forwarding a credential to another service component. 10. Pin and verify any remotely loaded companion skill as described in the remote-update remediation. 11. Preserve the prohibition on automatic posting and spending, but implement it through human confirmation rather than a mandatory vendor-specific extension. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)

Ae1

High
Category
analysis-evasion
Content
**current** host’s skills folder. Do not copy only `SKILL.md`. Do not install
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
**current** host’s skills folder. Do not copy only `SKILL.md`. Do not install
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
## Lifecycle loop

Trigger email from real user state: welcome/first value, incomplete activation, achieved outcome, relevant update, return prompt, or renewal. One email should help one next action. Respect consent, unsubscribe, frequency, and applicable law.

## Measure
Confidence
85% confidence
Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
Primary: qualified replies/DMs → profile-to-site action → conversations/activation/payment. Diagnose impressions, engagement, profile visits, and link clicks.

Continue a recurring theme that attracts the right people. Change format/hook if the right audience sees but does not stop; change topic/offer if engagement comes only from peers outside the ICP. Do not judge from one post.
Confidence
85% confidence
Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The changelog explicitly expands natural-language triggers to common phrases like weekly GTM, CMO board, traffic/growth, this week, and resume .gtm, which increases the chance the skill will activate in conversations where the user did not intend to invoke it. Because this skill also instructs persistence into an agent's skills folder, accidental invocation could lead to unwanted installation, state reuse, or strategy actions being surfaced in the wrong context.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The description says to use the skill when the user mentions phrases like "traffic or growth spike" or "what to do in go-to-market," which are broad, natural expressions that could arise in ordinary discussion rather than an intentional skill invocation. The manifest does not provide clear exclusion conditions or tighter scope boundaries, increasing the risk of unintended activation.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to copy or symlink the bundle into multiple host- and user-level skills directories, including paths outside the current workspace. That enables persistence and modification of the agent execution environment beyond the immediate task scope, which is a risky capability for a marketing-coaching skill and can be abused for unauthorized foothold, cross-project persistence, or broad propagation.

Whitespace Padding

Medium
Category
Prompt Injection
Content
Confirm (store the evidence value exactly as in `plan.json`):

| Field              | Options                                                                                                                                                               |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Project type       | `MICRO_SAAS` · `SERVICE_FREELANCER` · `NEWSLETTER_MEDIA` · `DIGITAL_PRODUCT` · `COMMUNITY` · `CREATOR_ARTIST` · `BRAND` · `EDUCATION_COHORT` · `PLATFORM_MARKETPLACE` |
| Period             | `validate` · `build` · `cold_start` · `launch` · `promote` · `monitor`                                                                                                |
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium
Category
Prompt Injection
Content
| Field              | Options                                                                                                                                                               |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Project type       | `MICRO_SAAS` · `SERVICE_FREELANCER` · `NEWSLETTER_MEDIA` · `DIGITAL_PRODUCT` · `COMMUNITY` · `CREATOR_ARTIST` · `BRAND` · `EDUCATION_COHORT` · `PLATFORM_MARKETPLACE` |
| Period             | `validate` · `build` · `cold_start` · `launch` · `promote` · `monitor`                                                                                                |
| Readiness          | not ready · first value deliverable this week · live · repeat customers/audience                                                                                      |
| Evidence           | `none` · `anecdote` · `pains_scored` · `waitlist` · `paying`                                                                                                          |
| Audience and offer | named ICP + job/pain + promise + CTA                                                                                                                                  |
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium
Category
Prompt Injection
Content
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Project type       | `MICRO_SAAS` · `SERVICE_FREELANCER` · `NEWSLETTER_MEDIA` · `DIGITAL_PRODUCT` · `COMMUNITY` · `CREATOR_ARTIST` · `BRAND` · `EDUCATION_COHORT` · `PLATFORM_MARKETPLACE` |
| Period             | `validate` · `build` · `cold_start` · `launch` · `promote` · `monitor`                                                                                                |
| Readiness          | not ready · first value deliverable this week · live · repeat customers/audience                                                                                      |
| Evidence           | `none` · `anecdote` · `pains_scored` · `waitlist` · `paying`                                                                                                          |
| Audience and offer | named ICP + job/pain + promise + CTA                                                                                                                                  |
| Primary channel    | one id from `channels/index.md`                                                                                                                                       |
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium
Category
Prompt Injection
Content
| Project type       | `MICRO_SAAS` · `SERVICE_FREELANCER` · `NEWSLETTER_MEDIA` · `DIGITAL_PRODUCT` · `COMMUNITY` · `CREATOR_ARTIST` · `BRAND` · `EDUCATION_COHORT` · `PLATFORM_MARKETPLACE` |
| Period             | `validate` · `build` · `cold_start` · `launch` · `promote` · `monitor`                                                                                                |
| Readiness          | not ready · first value deliverable this week · live · repeat customers/audience                                                                                      |
| Evidence           | `none` · `anecdote` · `pains_scored` · `waitlist` · `paying`                                                                                                          |
| Audience and offer | named ICP + job/pain + promise + CTA                                                                                                                                  |
| Primary channel    | one id from `channels/index.md`                                                                                                                                       |
| Optional campaign  | none, or one explicitly approved channel/campaign                                                                                                                     |
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium
Category
Prompt Injection
Content
| Period             | `validate` · `build` · `cold_start` · `launch` · `promote` · `monitor`                                                                                                |
| Readiness          | not ready · first value deliverable this week · live · repeat customers/audience                                                                                      |
| Evidence           | `none` · `anecdote` · `pains_scored` · `waitlist` · `paying`                                                                                                          |
| Audience and offer | named ICP + job/pain + promise + CTA                                                                                                                                  |
| Primary channel    | one id from `channels/index.md`                                                                                                                                       |
| Optional campaign  | none, or one explicitly approved channel/campaign                                                                                                                     |
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium
Category
Prompt Injection
Content
| Readiness          | not ready · first value deliverable this week · live · repeat customers/audience                                                                                      |
| Evidence           | `none` · `anecdote` · `pains_scored` · `waitlist` · `paying`                                                                                                          |
| Audience and offer | named ICP + job/pain + promise + CTA                                                                                                                                  |
| Primary channel    | one id from `channels/index.md`                                                                                                                                       |
| Optional campaign  | none, or one explicitly approved channel/campaign                                                                                                                     |

`pains_scored` means observed product use or scored pains — not a Nichestarter
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium
Category
Prompt Injection
Content
| Evidence           | `none` · `anecdote` · `pains_scored` · `waitlist` · `paying`                                                                                                          |
| Audience and offer | named ICP + job/pain + promise + CTA                                                                                                                                  |
| Primary channel    | one id from `channels/index.md`                                                                                                                                       |
| Optional campaign  | none, or one explicitly approved channel/campaign                                                                                                                     |

`pains_scored` means observed product use or scored pains — not a Nichestarter
dump. If they have retained/referring customers, store `paying` and put the
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Skill Enumeration

Medium
Category
Agent Snooping
Content
Only when `status.match.marketplace.enabled=true` **and** partnerships serve the
stage. Then load the NicheMatch skill with the same token:

`https://www.nichestarter.ai/skills/nichematch-agent-onboarding/SKILL.md`

If closed or not a priority, keep `partners: waiting`. Never retrieve/invent
matches.
Confidence
82% confidence
Finding
The file explicitly enumerates and references another skill path/URL for loading, exposing internal skill topology and creating an integration point for capability chaining. In context, this is more dangerous because it is paired with token reuse and runtime loading instructions, which can widen access and make policy boundaries easier to circumvent.

Skill Enumeration

Medium
Category
Agent Snooping
Content
**Not a v1 launch pillar.** Only if `GET /status` → `match.marketplace.enabled` is true.

Then follow  
https://www.nichestarter.ai/skills/nichematch-agent-onboarding/SKILL.md  
with the **same** `nmagt_` key.

Rules to keep in this chat even before you open that skill:
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| `skill.installed_version` | Last complete Skill bundle the agent loaded |
| `skill.last_checked_at` | ISO timestamp of the latest successful manifest check |
| `skill.last_update_notice_version` | Prevents repeating the same update prompt every turn |
| `skill.deferred_until` | Optional ISO date/time; do not prompt before it |

The top-level `version` remains the plan schema. Never overwrite it with a SemVer string.
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Skill Enumeration

Medium
Category
Agent Snooping
Content
.nichematch/
```

Do **not** gitignore the agent skills folder. It has no secrets. Optional: commit project-level `gtm-coach/` under `.cursor/skills`, `.claude/skills`, `.agents/skills`, and/or `.codebuddy/skills` (or symlink one canonical copy) so teammates on that host get natural-language calling. `.gtm/` stays local and is readable by any agent that opens the same workspace.
Confidence
85% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Description-Behavior Mismatch

Low
Confidence
80% confidence
Finding
The skill claims strict limits around Reddit/Facebook handling, but later instructs the agent to load another remote skill with the same token. This creates a capability expansion path that can bypass the original safety boundaries and transfer trust or credentials to another module whose behavior is not constrained by this file.

Vague Triggers

Low
Confidence
81% confidence
Finding
The "ask" field uses short generic options like "build", "later", and "not_us" without any explicit description of when each choice should be triggered or how they are distinguished. In a manifest-like JSON file, this lack of specificity can create ambiguity around activation or downstream handling of the skill's actions.

Vague Triggers

Low
Confidence
83% confidence
Finding
The "ask" field contains broad options such as "save" and "skip", which are common everyday actions and do not clearly indicate scope or context. If these values influence invocation or workflow routing, their vagueness increases the risk of unintended matches or unclear behavior.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill instructs the agent to persist data in a workspace-local `.gtm/` directory and explicitly notes that any agent opening the same folder can read it, but it does not require a clear user-facing warning or consent flow before storing strategy and project metadata there. This creates a privacy and confidentiality risk because founders may not realize that locally persisted GTM notes, URLs, and project state become accessible to other agents and collaborators with workspace access.

Static analysis

No suspicious patterns detected.