Security audit · expansion-signals

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code chunk is only infrastructure configuration for an Anthropic connector. While this may be a supporting component of a larger skill, on its own it does not perform or evidence the behavior described in the declared purpose. The description claims a full workflow for identifying expansion and renewal signals and notifying account teams, but the code merely registers a default LLM integration. That is a materially different behavior from the declared purpose for this chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code is broadly aligned with part of the description: it targets won customer deals approaching renewal, asks an analyst to judge expansion potential, and writes the resulting signal and reason onto the account. However, the declared description promises more than this chunk actually implements. Most notably, there is no Slack posting or digest generation in the supplied code. Also, the description emphasizes a weekly process, while this play is configured with changeKinds: ["added"], meaning records are processed only once when they enter the date window, not repeatedly each week for all relevant renewals. Finally, the description mentions outside events such as funding, hiring, or leadership changes and web search support, but this chunk does not itself show any such data access; that may exist inside the analyst, but it is not demonstrated here. Therefore the description does not accurately represent this specific code chunk's behavior.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
the two `close_date` values in `infra/plays/flag-expansion.ts` | A window that overlaps the next renewal judges the same account twice. |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
md
the two `close_date` values in `infra/plays/flag-expansion.ts` | A window that overlaps the next renewal judges the same account twice. |

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 85% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · infra/agents/digest.ts (reported line 28)May include surrounding context.
ts
languageModel: "claude-sonnet-5", // PLACEHOLDER: your model of choice maxSteps: 12, systemPrompt: [ "You post the weekly expansion digest for the customer team. You never judge an account yourself and you never message a customer.", "You have no clock of your own, so never assume the date. First read it with SQL: SELECT CURRENT_TIMESTAMP() AS now, CURRENT_DATE() AS today. Every 'now', 'this week' and date window below is measured from those values; write timestamps as ISO 8601 strings.", "1. Compute week_start, the Monday of the current ISO week, as YYYY-MM-DD. If the expansion_digests model already has a row with that week_start, stop: this week is posted.", "2. Query the gtm_accounts model in SQL for rows whose custom__expansion_signal_at falls in the last 7 days and whose custom__expansion_signal is not 'none'. Read name, website, owner_id, the signal and the reason.",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly sends customer/account information to external services: Anthropic for LLM judgments, web search for enrichment, and Slack for digests. Without a prominent privacy and data-handling warning, operators may deploy it without understanding that renewal status, account names, owners, and business context could leave the primary system boundary.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
**Derive before you ask.** An input with a lookup is looked up, not asked. | Input | Kind | How it is answered | Why it matters | | ----------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | where the customer book lives | derived | `cargo-ai storage model list` and `cargo-ai connection connector list`. Native models with rows: the default. A CRM with the deals: `crm-backed`. | Judging an empty native model while the deals sit in HubSpot is a pipeline that runs green and flags nothing. | | the renewal window | asked | the contract length most customers sign. Annual is the default: a won deal ten to twelve months old. | A monthly book judged on an annual window is judged once a year; a two-year book is judged a year early. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
**Derive before you ask.** An input with a lookup is looked up, not asked. | Input | Kind | How it is answered | Why it matters | | ----------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | where the customer book lives | derived | `cargo-ai storage model list` and `cargo-ai connection connector list`. Native models with rows: the default. A CRM with the deals: `crm-backed`. | Judging an empty native model while the deals sit in HubSpot is a pipeline that runs green and flags nothing. | | the renewal window | asked | the contract length most customers sign. Annual is the default: a won deal ten to twelve months old. | A monthly book judged on an annual window is judged once a year; a two-year book is judged a year early. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
## What you can change | Variation | When it is right | How | What it costs | | -------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm-backed` | The customers and deals live in HubSpot, Salesforce or Attio | Add a `defineConnector` for the CRM (`default: true`). Replace both native models with connector-backed ones: `extractSlug: "fetchRecords"`, `config: { objectType: "companies" }` and `"deals"`, `columnSelectionMode: "all"`, an hourly `schedule`, and never a filter. Run the play on the gtm_opportunities model with the CRM's won flag and close date (HubSpot: ...[truncated 26 chars]

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
## What you can change | Variation | When it is right | How | What it costs | | -------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm-backed` | The customers and deals live in HubSpot, Salesforce or Attio | Add a `defineConnector` for the CRM (`default: true`). Replace both native models with connector-backed ones: `extractSlug: "fetchRecords"`, `config: { objectType: "companies" }` and `"deals"`, `columnSelectionMode: "all"`, an hourly `schedule`, and never a filter. Run the play on the gtm_opportunities model with the CRM's won flag and close date (HubSpot: ...[truncated 26 chars]

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
## What you can change | Variation | When it is right | How | What it costs | | -------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm-backed` | The customers and deals live in HubSpot, Salesforce or Attio | Add a `defineConnector` for the CRM (`default: true`). Replace both native models with connector-backed ones: `extractSlug: "fetchRecords"`, `config: { objectType: "companies" }` and `"deals"`, `columnSelectionMode: "all"`, an hourly `schedule`, and never a filter. Run the play on the gtm_opportunities model with the CRM's won flag and close date (HubSpot: ...[truncated 26 chars]

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.
md
## What you can change | Variation | When it is right | How | What it costs | | -------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm-backed` | The customers and deals live in HubSpot, Salesforce or Attio | Add a `defineConnector` for the CRM (`default: true`). Replace both native models with connector-backed ones: `extractSlug: "fetchRecords"`, `config: { objectType: "companies" }` and `"deals"`, `columnSelectionMode: "all"`, an hourly `schedule`, and never a filter. Run the play on the gtm_opportunities model with the CRM's won flag and close date (HubSpot: ...[truncated 26 chars]

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
md
## What you can change | Variation | When it is right | How | What it costs | | -------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm-backed` | The customers and deals live in HubSpot, Salesforce or Attio | Add a `defineConnector` for the CRM (`default: true`). Replace both native models with connector-backed ones: `extractSlug: "fetchRecords"`, `config: { objectType: "companies" }` and `"deals"`, `columnSelectionMode: "all"`, an hourly `schedule`, and never a filter. Run the play on the gtm_opportunities model with the CRM's won flag and close date (HubSpot: ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
## What you can change | Variation | When it is right | How | What it costs | | -------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm-backed` | The customers and deals live in HubSpot, Salesforce or Attio | Add a `defineConnector` for the CRM (`default: true`). Replace both native models with connector-backed ones: `extractSlug: "fetchRecords"`, `config: { objectType: "companies" }` and `"deals"`, `columnSelectionMode: "all"`, an hourly `schedule`, and never a filter. Run the play on the gtm_opportunities model with the CRM's won flag and close date (HubSpot: ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
## What you can change | Variation | When it is right | How | What it costs | | -------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm-backed` | The customers and deals live in HubSpot, Salesforce or Attio | Add a `defineConnector` for the CRM (`default: true`). Replace both native models with connector-backed ones: `extractSlug: "fetchRecords"`, `config: { objectType: "companies" }` and `"deals"`, `columnSelectionMode: "all"`, an hourly `schedule`, and never a filter. Run the play on the gtm_opportunities model with the CRM's won flag and close date (HubSpot: ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
| Variation | When it is right | How | What it costs | | -------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm-backed` | The customers and deals live in HubSpot, Salesforce or Attio | Add a `defineConnector` for the CRM (`default: true`). Replace both native models with connector-backed ones: `extractSlug: "fetchRecords"`, `config: { objectType: "companies" }` and `"deals"`, `columnSelectionMode: "all"`, an hourly `schedule`, and never a filter. Run the play on the gtm_opportunities model with the CRM's won flag and close date (HubSpot: `hs_is_closed_won`, `clo ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
| Variation | When it is right | How | What it costs | | -------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm-backed` | The customers and deals live in HubSpot, Salesforce or Attio | Add a `defineConnector` for the CRM (`default: true`). Replace both native models with connector-backed ones: `extractSlug: "fetchRecords"`, `config: { objectType: "companies" }` and `"deals"`, `columnSelectionMode: "all"`, an hourly `schedule`, and never a filter. Run the play on the gtm_opportunities model with the CRM's won flag and close date (HubSpot: `hs_is_closed_won`, `clo ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
| -------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm-backed` | The customers and deals live in HubSpot, Salesforce or Attio | Add a `defineConnector` for the CRM (`default: true`). Replace both native models with connector-backed ones: `extractSlug: "fetchRecords"`, `config: { objectType: "companies" }` and `"deals"`, `columnSelectionMode: "all"`, an hourly `schedule`, and never a filter. Run the play on the gtm_opportunities model with the CRM's won flag and close date (HubSpot: `hs_is_closed_won`, `closedate`; or put it on companies and filter the `recent_deal_close_date` roll-up). Create three custom company properties (`expansion_signal` text, `expansion_reason` multi-line text, `expansion_signal_at` date) and replace `model.customColumn` with the CRM's `updateRecords` on `companies`, matched on the record id (`hs_object_id` of the deal's associated company), with those three mappings. | A write to a property that does not exist fails every row, so create them first. Never sit a unify step between the play and the write: it reports success and nothing lands. | | `window` | Contracts are not annual | Change the two `close_date` values in `infra/plays/flag-expansion.ts` ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.
md
| `crm-backed` | The customers and deals live in HubSpot, Salesforce or Attio | Add a `defineConnector` for the CRM (`default: true`). Replace both native models with connector-backed ones: `extractSlug: "fetchRecords"`, `config: { objectType: "companies" }` and `"deals"`, `columnSelectionMode: "all"`, an hourly `schedule`, and never a filter. Run the play on the gtm_opportunities model with the CRM's won flag and close date (HubSpot: `hs_is_closed_won`, `closedate`; or put it on companies and filter the `recent_deal_close_date` roll-up). Create three custom company properties (`expansion_signal` text, `expansion_reason` multi-line text, `expansion_signal_at` date) and replace `model.customColumn` with the CRM's `updateRecords` on `companies`, matched on the record id (`hs_object_id` of the deal's associated company), with those three mappings. | A write to a property that does not exist fails every row, so create them first. Never sit a unify step between the play and the write: it reports success and nothing lands. | | `window` | Contracts are not annual | Change the two `close_date` values in `infra/plays/flag-expansion.ts` | A window that overlaps the next renewal judges the same account twice. | | `whole-book` | You want every customer judged on a cadence, not only near renewal | Move the play to `gtm_accounts`, filter on `custom__expansion_signal_at` being empty or older than ninety da ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
md
| `window` | Contracts are not annual | Change the two `close_date` values in `infra/plays/flag-expansion.ts` | A window that overlaps the next renewal judges the same account twice. | | `whole-book` | You want every customer judged on a cadence, not only near renewal | Move the play to `gtm_accounts`, filter on `custom__expansion_signal_at` being empty or older than ninety days, and let the analyst decide in SQL whether the account has a win at all | Every account in the book is judged each cycle, customers or not, at one agent run and up to three searches each. | | `no-web` | Compliance does not allow web research on customers | Drop `webSearch` from the analyst and its search sentence ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
md
| `window` | Contracts are not annual | Change the two `close_date` values in `infra/plays/flag-expansion.ts` | A window that overlaps the next renewal judges the same account twice. | | `whole-book` | You want every customer judged on a cadence, not only near renewal | Move the play to `gtm_accounts`, filter on `custom__expansion_signal_at` being empty or older than ninety days, and let the analyst decide in SQL whether the account has a win at all | Every account in the book is judged each cycle, customers or not, at one agent run and up to three searches each. | | `no-web` | Compliance does not allow web research on customers | Drop `webSearch` from the analyst and its search sentence ...[truncated 26 chars]

expansion-signals

Overview

A.I.G

SkillSpector

Tp4

Tp4

Ae1

Ae1

Anti-Refusal Statement

Missing User Warnings

Whitespace Padding

Whitespace Padding

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Static analysis