other
- Location
scripts/create_elevator_pitch.py:61- Finding
Generated pitches contain fabricated business claims presented as facts
- Content
View full analysis
Vulnerability Details
File Location:
scripts/create_elevator_pitch.py, lines 61-76
Vulnerability Type: Fabricated business claims
Risk Level: MediumVulnerable Code
python print("We've signed 12 customers and are growing 20% monthly") print(f"\n[ASK - 10 sec]") if args.audience == 'investor': print("We're raising $500K to hit $30K MRR. Are you interested?") elif args.audience == 'customer': print("Can I show you a 5-minute demo next week?") else: # 120 seconds print(f"\n[HOOK - 15 sec]") print(f"{problem}") print(f"\n[SOLUTION - 30 sec]") print(f"{company} {solution}") print(f"\n[MARKET - 20 sec]") print("This is a $2B market growing 30% annually") print(f"\n[TRACTION - 30 sec]") print("12 customers, $15K MRR, growing 20% monthly, 58 NPS") print(f"\n[TEAM - 15 sec]") print("Ex-Stripe and Google engineers")Technical Analysis
The script retrieves the company, problem statement, and solution from the selected foundation, but it does not retrieve or validate the market size, customer count, revenue, growth, NPS, team background, fundraising target, or intended use of funds.
Instead, it inserts fixed claims into generated pitches and presents them as genuine facts. These values are not marked as examples or placeholders. Consequently, unrelated companies receive the same unsupported claims, including:
- 12 signed customers
- 20% monthly growth
- A $2 billion market growing 30% annually
- $15,000 in monthly recurring revenue
- An NPS of 58
- Former Stripe and Google engineers
- A $500,000 seed-round target tied to $30,000 MRR
This is a business-integrity and safety defect rather than a traditional privilege-escalation vulnerability. It conflicts with the skill's advisory purpose because a user could reasonably interpret the generated output as a pitch tailored from their stored foundation.
Attack Path
1 ...[truncated 1342 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all fixed traction, market, team, and fundraising assertions from production output.
- Read each factual claim from the selected foundation record, using explicit fields for customer count, MRR, growth, NPS, market size, market growth, team history, fundraising target, and intended use of funds.
- Omit sections for which verified data is unavailable rather than supplying invented values.
- If templates are needed, visibly mark them as placeholders, such as
[INSERT VERIFIED MRR], and never render example values as factual prose. - Require explicit user confirmation of material factual claims before producing a presentation-ready pitch.
- Validate
--lengthwithchoices=[30, 60, 120]so unsupported values do not silently enter the 120-second branch. - Add automated tests using empty and unrelated foundations to ensure that no unprovided business metric or credential appears in generated output.
- Display a concise warning that all figures and credentials must be verified before external use.