Security audit

agentic-engagement

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently sets up a Cargo email conversation agent with bounded follow-up behavior, but users still need to handle outreach consent and compliance before deploying it.

Before installing or deploying, confirm the sending domain and mailbox identity are authorized, review the Cargo CDK plan, approve any recurring mailbox or domain charges explicitly, and make sure outreach has a lawful basis, honors opt-outs, and follows applicable email and privacy rules. Test with your own address before contacting leads.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description claims this skill deploys an end-to-end email conversation agent stack, but the provided code chunk only defines a domain resource. While domain setup is one supporting component of the declared system, the actual code does not implement the primary behavior described: no mailbox, no agent, no inbound reply handling, no unsubscribe trigger, no heartbeat, and no thread management. This is therefore a material description-to-behavior mismatch.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description claims a broader skill that stands up an email conversation agent with mailbox, domain, agent, native triggers, heartbeat, and sendEmail support. The supplied code only provisions a mailbox via `defineMailbox` using an already imported domain. While mailbox setup is consistent as one supporting piece of the declared system, this chunk does not actually implement the core declared behavior of handling conversations with leads or replying to inbound email. Because the primary purpose represented by the description is a full conversation-agent deployment and the actual code is limited to mailbox creation, this is a material description-to-behavior mismatch for the supplied code chunk.

Ae1

High

Category: analysis-evasion
Content: - `node --import tsx evals/contract.mjs` passes against the adapted graph
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - `node --import tsx evals/contract.mjs` passes against the adapted graph
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README describes an autonomous email agent that continues conversations, sends follow-ups on silence, and reacts to replies/unsubscribes, but it does not prominently warn about consent, anti-spam, privacy, retention, or regulatory obligations. In an outbound lead-engagement context, this omission can encourage deployment without adequate controls, increasing risk of unsolicited messaging, mishandling personal data, and compliance violations.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: This agent is configured to use an email-sending tool and to wake on a heartbeat to continue checking thread status, which implies it may autonomously send or follow up on outreach emails. The file contains descriptive comments about behavior, but no user disclosure, confirmation prompt, or warning that the agent may contact leads automatically and continue outreach over time.

Static analysis

No suspicious patterns detected.