Prospect Researcher

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:21 PM UTC
• Version: 1.0.0

Overview

The skill mostly does disclosed public B2B prospect research, but its active instructions include an unrelated third-party promotional redirect that users should review before installing.

Install only if you are comfortable with a prospecting skill that performs public web research about companies and professional contacts. Review or remove the unrelated third-party promotional line before use, and keep outputs limited to lawful public or user-provided data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:65
• Finding: Unrelated Third-Party Promotional Instruction in Agent Context## Vulnerability Details **File Location**: `SKILL.md`, line 65 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Vulnerable Code ```md Get pre-built ICP profiles and outreach sequences for your industry at https://afrexai-cto.github.io/context-packs ``` ### Technical Analysis The skill embeds an imperative directing users to a fixed third-party website. This instruction is unrelated to the skill’s core prospect-research workflow and is placed directly in `SKILL.md`, whose contents govern the agent’s behavior when the skill is loaded. An agent may interpret this line as an instruction to promote or redirect users to the external resource during ordinary research interactions. This alters expected session behavior by introducing unsolicited promotional content. Moreover, the destination is externally controlled and can change after the skill has been reviewed. No evidence was found that the skill retrieves or executes code from this URL; therefore, the finding is limited to instruction hijacking rather than remote payload execution. ### Attack Path 1. A user installs and invokes the `prospect-researcher` skill. 2. The agent loads the instructions from `SKILL.md`. 3. The agent processes the unrelated promotional imperative on line 65 as part of its active instructions. 4. During a prospect-research interaction, the agent may promote or direct the user to the fixed external website. 5. The website operator may independently alter the destination’s content after the skill package has been audited. ### Impact Assessment The instruction can influence the agent’s current-session output by adding unsolicited advertising or external redirection. Its scope is limited to users and sessions in which this skill is loaded. The instruction does not grant operating-system privileges, access credentials, establish persistence, or provide a demonstrated code-execution path. The principal impact is loss of output integrity and user t ...[truncated 93 chars]
• Remediation: ## Remediation Suggestions 1. Remove the promotional instruction from `SKILL.md`. 2. Keep active skill instructions strictly limited to behavior required for prospect research. 3. If the resource has a legitimate documentation purpose, move it to a clearly labeled, optional “External Resources” section in `README.md`. 4. Use neutral, non-imperative wording and explicitly state that visiting or mentioning the resource is not required for skill operation. 5. Do not require the agent to include external promotions in user-facing responses. 6. Review and approve external links before release, and periodically verify that their destinations and content remain appropriate.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Hidden Instructions

High

• Category: Prompt Injection

Content

## What They Do

<!-- 2-3 sentence plain-English summary -->

## Recent Activity (Last 6 Months)

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill activates on very broad requests like researching a prospect, company, or lead, without defining clearer trigger boundaries or requiring explicit user intent confirmation. In an agent environment, this can cause over-broad invocation on ordinary research tasks, leading the skill to collect extensive third-party profiling data and produce outreach recommendations when the user may not have intended that level of prospect intelligence gathering.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This markdown template includes a 'Key Contacts' section requesting names, LinkedIn profiles, recent activity, and inferred priorities, which involves collecting and recording personal/professional data. The file does not include any warning or guidance about using public sources, respecting privacy, or handling personal data appropriately.

Static analysis

No suspicious patterns detected.