outreach-sequence-crafter

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:09 AM UTC
• Version: 1.0.0

Overview

This is a small outreach-drafting skill with a local helper script and no evidence of hidden networking, credential use, persistence, or destructive behavior.

Install only if you want an outreach/cadence drafting helper. Review generated copy before sending it, provide only the business context needed for the draft, and be aware that the included script is a basic starter that writes a local JSON file rather than a complete campaign system.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code does partially align with the declared purpose because it builds a basic multi-touch outreach sequence and includes follow-up timing. However, the declared description promises broader functionality: channel mix, objection handling, and logging templates. The actual code only emits a fixed JSON structure with four touchpoints and a preset name, without any channel information, objection handling, or logging template generation. This is a material gap between the described capabilities and the implemented behavior.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger examples are broad, natural-language phrases that could cause the skill to activate in contexts where the user did not clearly request outreach-sequence generation. In an agent environment, over-broad invocation increases the chance of unintended use on sensitive business content or of the skill being selected when a narrower, safer workflow would be more appropriate.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrase "写邀约话术" is short and generic, and could match a wide range of ordinary writing-assistance requests rather than a narrowly scoped skill invocation. The file provides example trigger words but does not define boundaries, exclusions, or when this skill should not activate.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: "build an outreach sequence" reads like a natural everyday instruction to an assistant, not a clearly scoped activation phrase. Because the file labels these as example triggers without clarifying invocation rules or negative examples, unintended activation is more likely.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The phrase "招商邀约流程" identifies a business area but still lacks explicit scope, constraints, or exclusion criteria for when the skill applies. In a manifest-like prompt description, this can make activation conditions unclear to both users and orchestrators.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The file presents headings and content in both Chinese and English, but does not state whether the skill will respond in the user's preferred language or allow locale selection. This can create an implicit language policy without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The file includes both Chinese and English trigger phrases, but the instructions do not state whether outputs should match the user's language or let the user opt into a preferred language. This can create a locale-policy issue because the skill's language behavior is left implicit rather than user-directed.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The file presents headings and instructions in Chinese while key trigger phrases and outputs are partly in English, but it does not state whether language should follow user preference. This may create an implicit language policy or inconsistent output behavior without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown file contains user-facing natural-language instructions entirely in Chinese, beginning at the section headings and continuing through the test steps. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation when no justification or alternative is provided.

Static analysis

No suspicious patterns detected.