Security audit

Outreach Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill is an outreach-writing helper, but it asks agents to persist contact, rate, and pipeline records even though its manifest declares only read access.

Install only if you are comfortable with the agent storing outreach artifacts and proposing creator-registry updates containing contact paths, rates, and response history. Prefer a version whose manifest declares narrow write permissions, asks before persisting sensitive relationship data, and keeps shared hot-cache entries minimal.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:36
Finding: Persistent State Writes Exceed the Declared Capability Ceiling
Content: View full analysis
.md` — the [creator-registry](../../../protocol/creator-registry/SKILL.md) roster record — for the confirmed contact path, last agreed rate, and negotiation/response history. - **Writes**: outreach artifact (pitches, follow-up sequence, negotiation guide, pipeline tracker) to `memory/influencer/outreach-manager/YYYY-MM-DD-.md`. When a cycle closes, the closed outcome (final agreed rate, response history, confirmed contact path) goes as a one-line update to `memory/events/creators.ndjson` via an authorized `operation: propose` request to `registry-events.py` — only `creator-registry` writes canonical roster records. - **Promotes**: durable facts (confirmed partners, agreed rates, top objection patterns, response-rate baselines) to `memory/hot-cache.md`. ``` The write operation is repeated in the workflow at `SKILL.md:70`: ```markdown 5. **Track outreach pipeline** — record stage counts and conversion rates, a per-creator detailed pipeline, today's prioritized actions, and pipeline health (response rate, confirmation rate, time-to-confirm, top objection). Template: [Step 5](references/templates.md#step-5--outreach-pipeline-tracker). Act ...[truncated 3484 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The display name, summary, and description include Chinese text alongside English, which imposes a multilingual presentation choice on all users without any stated opt-in or locale selection. Under the policy for natural-language violations, forced language or locale behavior should either be optional or clearly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.