Security audit

List Segment Builder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed email-list segmentation helper with purpose-aligned memory output and an optional dry-run-by-default ESP sync path.

Installers should expect this skill to read subscriber and consent-related exports and write aggregate segmentation notes. Do not use the optional ESP --live sync unless you intend to mutate the email platform suppression state and have verified the affected contacts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
- **Reads**: the user's own list/CRM CSV (subscribe date, last-open/last-click date, opt-in status), ESP campaign export (opens/clicks per subscriber), GA4/ecommerce export (order recency, frequency, monetary value); the program goal (promo / retention / cold); and consent/suppression facts from the [consent-registry](../../../protocol/consent-registry/SKILL.md) (`memory/consent/`). - **Writes**: a user-facing segment map and reusable summary to `memory/email/list-segment-builder/`. - **Promotes**: the segment names, the lifecycle-stage map, the suppression-rule set, and any missing export to `memory/hot-cache.md` and `memory/open-loops.md`; propose durable segment definitions as pending-decision items (never write consent records — the registry owns `memory/consent/`). - **Done when**: each segment is named and grounded in an exported column; every size is labeled Measured or Estimated; RFM tiers use the user's own recency/frequency/monetary fields; the suppression list reconciles against the consent-registry (unsubscribed + hard-bounced + complained + consent-withdrawn) or flags NEEDS_INPUT where no consent record exists; and the SEND **E** relevance of each bucket is noted. - **Primary next skill**: [email-creative-builder](../../engage/email-creative-builder/SKILL.md) to compose for the top segment, or [email-sequence-designer](../../nurture/email-sequence-designer/SKILL.md) to design a flow per lifecycle stage. ### Handoff Summary

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
- **Reads**: the user's own list/CRM CSV (subscribe date, last-open/last-click date, opt-in status), ESP campaign export (opens/clicks per subscriber), GA4/ecommerce export (order recency, frequency, monetary value); the program goal (promo / retention / cold); and consent/suppression facts from the [consent-registry](../../../protocol/consent-registry/SKILL.md) (`memory/consent/`). - **Writes**: a user-facing segment map and reusable summary to `memory/email/list-segment-builder/`. - **Promotes**: the segment names, the lifecycle-stage map, the suppression-rule set, and any missing export to `memory/hot-cache.md` and `memory/open-loops.md`; propose durable segment definitions as pending-decision items (never write consent records — the registry owns `memory/consent/`). - **Done when**: each segment is named and grounded in an exported column; every size is labeled Measured or Estimated; RFM tiers use the user's own recency/frequency/monetary fields; the suppression list reconciles against the consent-registry (unsubscribed + hard-bounced + complained + consent-withdrawn) or flags NEEDS_INPUT where no consent record exists; and the SEND **E** relevance of each bucket is noted. - **Primary next skill**: [email-creative-builder](../../engage/email-creative-builder/SKILL.md) to compose for the top segment, or [email-sequence-designer](../../nurture/email-sequence-designer/SKILL.md) to design a flow per lifecycle stage. ### Handoff Summary

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill repeatedly claims it is read-only with respect to consent handling and primarily performs segmentation, but this section documents an operational path that can execute a live suppression sync to an ESP. That mismatch is dangerous because an agent or user may trust the earlier scope guard and trigger external state changes they did not expect, causing unintended list mutations or suppressions in production.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation says the skill only reads the consent registry and never writes it, yet nearby text instructs use of a command that can push suppressions live to an external ESP. Even if the local registry remains read-only, the practical effect is still a production-side mutation to mailing eligibility, which can be misinterpreted as safe and non-mutating by orchestrators or reviewers.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.