Billionverify Skill

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:30 AM UTC
• Version: 0.1.0

Overview

This is a straightforward BillionVerify API helper, but it can send email lists/files and webhook URLs to BillionVerify and may consume paid credits.

Install from a trusted, pinned source where possible. Before using bulk or file verification, confirm you are authorized to send those email addresses to BillionVerify, remove unrelated spreadsheet data, and understand credit usage. Use only webhook URLs you control, prefer HTTPS, and store downloaded result files and webhook secrets securely.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:12
• Finding: Unpinned Package Execution During Installation<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 12–18 **Vulnerability Type**: Unpinned third-party package and mutable Skill installation **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add BillionVerify/billionverify-skill ``` Or install to specific agents: ```bash npx skills add BillionVerify/billionverify-skill -a cursor -a claude-code ``` ### Technical Analysis The installation instructions invoke the `skills` CLI through `npx` without pinning the CLI to a reviewed version or verifying its integrity. Depending on the local environment and cache state, `npx` may download package code from the configured npm registry and execute it with the installing user's privileges. The referenced `BillionVerify/billionverify-skill` source is also not pinned to an immutable version or commit. Consequently, the content installed by these commands can change after this audit. Compromise of the npm package, registry resolution process, CLI release, publisher account, or referenced upstream repository could therefore introduce unreviewed code or modified Skill instructions. ### Attack Path 1. An attacker compromises the package publisher, npm package, configured registry, CLI distribution, or referenced upstream Skill repository. 2. The attacker publishes a malicious or altered version while retaining the expected package or repository identifier. 3. A user follows the documented unpinned `npx skills add` command. 4. `npx` retrieves and executes the mutable third-party CLI package, or the CLI retrieves the modified Skill content. 5. Attacker-controlled code executes with the installing user's privileges, or malicious Skill instructions are installed into supported agents. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the account running the installation command. The resulting access would be limited by that account's operating-system privileges but could include reading or modifying ...[truncated 289 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` CLI to a specific reviewed version rather than invoking an implicitly selected release. 2. Pin the BillionVerify Skill to an immutable release or commit hash supported by the installer. 3. Use package-locking and integrity verification mechanisms where supported. 4. Document the expected official npm registry and source repository so users can detect unexpected package resolution. 5. Verify package signatures, checksums, provenance attestations, or published integrity hashes before execution. 6. Review new CLI and Skill versions before updating pinned references. 7. Run installation with the least-privileged account appropriate for the task and avoid elevated execution. 8. Prefer installation workflows that download and inspect package contents before executing installation scripts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly encourages sending email addresses, uploaded files, and webhook destinations to a third-party verification service but does not warn users that this involves external data transfer and potential disclosure of personal or sensitive data. In a privacy-sensitive context, users may unknowingly submit customer lists or internal addresses to an external processor, creating compliance, confidentiality, and consent risks.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Verify Single Email
```bash
curl -X POST "https://api.billionverify.com/v1/verify/single" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 82% confidence
• Finding: The hardcoded external API base URL indicates network transmission to a third-party domain. Although expected for an API integration skill, it is still security-relevant because it moves user-supplied data and authentication headers outside the local trust boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Verify Single Email
```bash
curl -X POST "https://api.billionverify.com/v1/verify/single" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 82% confidence
• Finding: The hardcoded external API base URL indicates network transmission to a third-party domain. Although expected for an API integration skill, it is still security-relevant because it moves user-supplied data and authentication headers outside the local trust boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Verify Batch Emails (max 50)
```bash
curl -X POST "https://api.billionverify.com/v1/verify/bulk" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 91% confidence
• Finding: Batch verification sends multiple email addresses at once to an external service, increasing the volume of personal data transmitted in a single action. This raises privacy and operational risk if large contact lists are submitted without user awareness or authorization.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs users to upload email lists and send verification data to a third-party API but does not clearly warn that potentially sensitive personal data leaves the local environment. This can lead to inadvertent disclosure of customer or prospect email datasets to an external processor without informed user consent or policy review.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Upload File for Bulk Verification
Upload CSV, Excel (.xlsx/.xls), or TXT files (max 20MB, 100,000 emails):
```bash
curl -X POST "https://api.billionverify.com/v1/verify/file" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \
  -F "file=@/path/to/emails.csv" \
  -F "check_smtp=true" \

• Confidence: 98% confidence
• Finding: The file upload feature transmits entire CSV/Excel/TXT datasets containing up to 100,000 email addresses to a third-party API. This materially increases the risk of bulk personal-data exposure, accidental transfer of unrelated spreadsheet contents, and compliance violations if users are not warned and data is not minimized.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Get File Job Status
Supports long-polling with `timeout` parameter (0-300 seconds):
```bash
curl -X GET "https://api.billionverify.com/v1/verify/file/{task_id}?timeout=30" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Get File Job Status
Supports long-polling with `timeout` parameter (0-300 seconds):
```bash
curl -X GET "https://api.billionverify.com/v1/verify/file/{task_id}?timeout=30" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Get File Job Status
Supports long-polling with `timeout` parameter (0-300 seconds):
```bash
curl -X GET "https://api.billionverify.com/v1/verify/file/{task_id}?timeout=30" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Get File Job Status
Supports long-polling with `timeout` parameter (0-300 seconds):
```bash
curl -X GET "https://api.billionverify.com/v1/verify/file/{task_id}?timeout=30" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Get File Job Status
Supports long-polling with `timeout` parameter (0-300 seconds):
```bash
curl -X GET "https://api.billionverify.com/v1/verify/file/{task_id}?timeout=30" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Download Verification Results
Without filters returns redirect to full result file. With filters returns CSV of matching emails (filters combined with OR logic):
```bash
curl -X GET "https://api.billionverify.com/v1/verify/file/{task_id}/results?valid=true&invalid=true" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \
  -L -o results.csv
```

• Confidence: 87% confidence
• Finding: Downloading verification results retrieves processed email-list data from the external provider, potentially writing sensitive results to a local file. This can expose enriched contact intelligence or deliverability assessments if the storage location is insecure or if users were unaware such data would be fetched from a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Create Webhook
```bash
curl -X POST "https://api.billionverify.com/v1/webhooks" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 84% confidence
• Finding: Creating a webhook sends a user-controlled callback URL to the third-party service and establishes future server-to-server communications. If configured carelessly, this can expose internal endpoints, create SSRF-like operational risk on the vendor side, or leak event data to an unintended destination.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The README documents webhook creation, listing, and deletion without warning that webhooks create external callbacks and can affect system behavior or leak metadata to attacker-controlled endpoints if misconfigured. In agent-driven environments, this can enable unintended outbound communication or operational changes without adequate user awareness.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The skill notes credit consumption but does not present it as a user-facing warning before actions are taken. Users may unknowingly trigger paid API operations, causing unintended billing impact or depletion of account credits.

Static analysis

No suspicious patterns detected.