Security audit · new-hire-detection

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
ICP, shows up in a Slack channel the team reads: who they are, where they landed, why the company fits, and the links. Not a list pulled once: a pipeline that keeps watching. A person entering a new role is the cleanest buying signal in B2B: fresh budget, a mandate to change things, and no loyalty yet to the vendor already in place. Most of the market is not worth a rep's time, so every company is qualified against the ICP in the workspace context first, and only the ones that fit are posted. A channel that hears about everyone stops being read.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs use of npx skills with a floating package reference, which can fetch and execute whatever version is current at runtime. That creates a supply-chain risk because a compromised or breaking upstream release could execute arbitrary code during installation or skill management.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
npx skills add getcargohq/cargo-skills --skill cargo-cdk

text
Then read `.agents/skills/cargo-cdk/SKILL.md` directly; no session reload is needed. Complete its bootstrap and use its authoring, state, plan, and deployment rules throughout. Stop before any search or template work if the skill cannot be installed or read.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.
md
**Derive before you ask.** An input with a lookup is looked up, not asked. Only the ones marked _asked_ genuinely live in the operator's head. | Input | Kind | How it is answered | Why it matters | | --------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `market` | derived | Titles, industries, headcount band and locations, read from the ICP in the workspace context. Ask for exactly these four only when no ICP exists and no company domain can be researched, then write them to `context/icp.md` | It is the audience. The qualifier reads the same ICP, so a market that lives only in a URL leaves the agent judging against nothing | | `search_size` | derived | `searchPersonMetrics` on each candidate URL, as in references/search.md | Above 2,500 a single URL silently stops at 2,500 and the rest of the market is never seen |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.
md
**Derive before you ask.** An input with a lookup is looked up, not asked. Only the ones marked _asked_ genuinely live in the operator's head. | Input | Kind | How it is answered | Why it matters | | --------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `market` | derived | Titles, industries, headcount band and locations, read from the ICP in the workspace context. Ask for exactly these four only when no ICP exists and no company domain can be researched, then write them to `context/icp.md` | It is the audience. The qualifier reads the same ICP, so a market that lives only in a URL leaves the agent judging against nothing | | `search_size` | derived | `searchPersonMetrics` on each candidate URL, as in references/search.md | Above 2,500 a single URL silently stops at 2,500 and the rest of the market is never seen |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.
md
| Input | Kind | How it is answered | Why it matters | | --------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `market` | derived | Titles, industries, headcount band and locations, read from the ICP in the workspace context. Ask for exactly these four only when no ICP exists and no company domain can be researched, then write them to `context/icp.md` | It is the audience. The qualifier reads the same ICP, so a market that lives only in a URL leaves the agent judging against nothing | | `search_size` | derived | `searchPersonMetrics` on each candidate URL, as in references/search.md | Above 2,500 a single URL silently stops at 2,500 and the rest of the market is never seen | | `slack_channel` | asked | Which channel the team reads for this. Resolve its id through the Slack connector's autocomplete; never type a name | A channel nobody owns is a channel nobody reads, and a wrong id posts somewhere else or nowhere ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
md
| --------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `market` | derived | Titles, industries, headcount band and locations, read from the ICP in the workspace context. Ask for exactly these four only when no ICP exists and no company domain can be researched, then write them to `context/icp.md` | It is the audience. The qualifier reads the same ICP, so a market that lives only in a URL leaves the agent judging against nothing | | `search_size` | derived | `searchPersonMetrics` on each candidate URL, as in references/search.md | Above 2,500 a single URL silently stops at 2,500 and the rest of the market is never seen | | `slack_channel` | asked | Which channel the team reads for this. Resolve its id through the Slack connector's autocomplete; never type a name | A channel nobody owns is a channel nobody reads, and a wrong id posts somewhere else or nowhere | | `cadence` | asked | Whether it should run on its own, and how often. Default: every two weeks (the 1st and the 15th). The alternative is on demand | Every sync re-extracts and re-bills the whole search, so cadence is the main cost dial, traded aga ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
| `search_size` | derived | `searchPersonMetrics` on each candidate URL, as in references/search.md | Above 2,500 a single URL silently stops at 2,500 and the rest of the market is never seen | | `slack_channel` | asked | Which channel the team reads for this. Resolve its id through the Slack connector's autocomplete; never type a name | A channel nobody owns is a channel nobody reads, and a wrong id posts somewhere else or nowhere | | `cadence` | asked | Whether it should run on its own, and how often. Default: every two weeks (the 1st and the 15th). The alternative is on demand | Every sync re-extracts and re-bills the whole search, so cadence is the main cost dial, traded against how fresh a new hire is when the team hears about it | | `crm` | derived | Inspect the authenticated connectors. None: nothing to ask. One or more: offer the CRM variations once, with their cost | The template needs no CRM; a team that has one usually wants at least to know whether the company is already in it | Checked before moving on, not after the deploy:

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.
md
The code is a worked example. These reshapes are expected, and the agent offers them rather than waiting to be asked. Every one costs something; that is what makes it a variation and not the default. | Variation | When it is right | How | What it costs | | --------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm_lookup` | A CRM is connected and the team wants to know, on the post, whether the company is already in it | Add the CRM connector, the lookup script, and one account lookup before the post (`references/crm-adaptation.md`) | A CRM lookup per qualified person, and one more connector to keep authorized. Nothing is written | | `crm_routing` | The CRM is where the team works, and a task on the right owner beats a Slack message | Replace the post with the routed CRM writes in `references/crm-adaptation.md`: create, alert the deal owner, welcome at a customer | Owner IDs, a CSM field, association types and a LinkedIn field to resolve; an email lookup per person; writes that a mistake leaves in the CRM |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.
md
The code is a worked example. These reshapes are expected, and the agent offers them rather than waiting to be asked. Every one costs something; that is what makes it a variation and not the default. | Variation | When it is right | How | What it costs | | --------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm_lookup` | A CRM is connected and the team wants to know, on the post, whether the company is already in it | Add the CRM connector, the lookup script, and one account lookup before the post (`references/crm-adaptation.md`) | A CRM lookup per qualified person, and one more connector to keep authorized. Nothing is written | | `crm_routing` | The CRM is where the team works, and a task on the right owner beats a Slack message | Replace the post with the routed CRM writes in `references/crm-adaptation.md`: create, alert the deal owner, welcome at a customer | Owner IDs, a CSM field, association types and a LinkedIn field to resolve; an email lookup per person; writes that a mistake leaves in the CRM |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.
md
The code is a worked example. These reshapes are expected, and the agent offers them rather than waiting to be asked. Every one costs something; that is what makes it a variation and not the default. | Variation | When it is right | How | What it costs | | --------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm_lookup` | A CRM is connected and the team wants to know, on the post, whether the company is already in it | Add the CRM connector, the lookup script, and one account lookup before the post (`references/crm-adaptation.md`) | A CRM lookup per qualified person, and one more connector to keep authorized. Nothing is written | | `crm_routing` | The CRM is where the team works, and a task on the right owner beats a Slack message | Replace the post with the routed CRM writes in `references/crm-adaptation.md`: create, alert the deal owner, welcome at a customer | Owner IDs, a CSM field, association types and a LinkedIn field to resolve; an email lookup per person; writes that a mistake leaves in the CRM |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
| `crm_routing` | The CRM is where the team works, and a task on the right owner beats a Slack message | Replace the post with the routed CRM writes in `references/crm-adaptation.md`: create, alert the deal owner, welcome at a customer | Owner IDs, a CSM field, association types and a LinkedIn field to resolve; an email lookup per person; writes that a mistake leaves in the CRM | | `cadence` | The market is small and a weekly signal matters, or the budget is tight and monthly is enough | Change the cron added when opening up (`infra/models/new-hires.ts`), or add none and sync on demand | Weekly roughly doubles the extraction spend of the default for the same people found; monthly halves it and the team hears about a new hire weeks later | | `split_search` | The counted search is above 2,500 | One URL per region or headcount band in `urls` (`infra/models/new-hires.ts`), each counted | More URLs to keep in sync with the ICP; overlapping splits extract the same person twice and bill both | | `channel_per_segment` | Different teams own different segments (regions, tiers) | Branch on the qualifier's `fit_tier` or the search URL's facet and lock one channel id per branch (`infra/plays/route-new-hires.ts`) | One channel id per branch to resolve and keep current | | `find_email` | The team wants the work email on the post, ready for its own sequencer | Add Cargo's native Find Email tool after the gate and put the email on the post (`infra/plays/route-new-hires.ts`) | One email lookup per qualified person ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
md
| `cadence` | The market is small and a weekly signal matters, or the budget is tight and monthly is enough | Change the cron added when opening up (`infra/models/new-hires.ts`), or add none and sync on demand | Weekly roughly doubles the extraction spend of the default for the same people found; monthly halves it and the team hears about a new hire weeks later | | `split_search` | The counted search is above 2,500 | One URL per region or headcount band in `urls` (`infra/models/new-hires.ts`), each counted | More URLs to keep in sync with the ICP; overlapping splits extract the same person twice and bill both | | `channel_per_segment` | Different teams own different segments (regions, tiers) | Branch on the qualifier's `fit_tier` or the search URL's facet and lock one channel id per branch (`infra/plays/route-new-hires.ts`) | One channel id per branch to resolve and keep current | | `find_email` | The team wants the work email on the post, ready for its own sequencer | Add Cargo's native Find Email tool after the gate and put the email on the post (`infra/plays/route-new-hires.ts`) | One email lookup per qualified person | | `draft_first_touch` | The team wants a first email written, not just the signal | Add a writing agent after the gate and put its draft in the post (`infra/plays/route-new-hires.ts`) | One more LLM call per qualified person, and copy that has to be reviewed before it i ...[truncated 24 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/crm-adaptation.md (reported line 785)May include surrounding context.
md
| `cadence` | The market is small and a weekly signal matters, or the budget is tight and monthly is enough | Change the cron added when opening up (`infra/models/new-hires.ts`), or add none and sync on demand | Weekly roughly doubles the extraction spend of the default for the same people found; monthly halves it and the team hears about a new hire weeks later | | `split_search` | The counted search is above 2,500 | One URL per region or headcount band in `urls` (`infra/models/new-hires.ts`), each counted | More URLs to keep in sync with the ICP; overlapping splits extract the same person twice and bill both | | `channel_per_segment` | Different teams own different segments (regions, tiers) | Branch on the qualifier's `fit_tier` or the search URL's facet and lock one channel id per branch (`infra/plays/route-new-hires.ts`) | One channel id per branch to resolve and keep current | | `find_email` | The team wants the work email on the post, ready for its own sequencer | Add Cargo's native Find Email tool after the gate and put the email on the post (`infra/plays/route-new-hires.ts`) | One email lookup per qualified person | | `draft_first_touch` | The team wants a first email written, not just the signal | Add a writing agent after the gate and put its draft in the post (`infra/plays/route-new-hires.ts`) | One more LLM call per qualified person, and copy that has to be reviewed before it i ...[truncated 24 chars]

Unbounded Output

Medium

Category: Output Handling
Confidence: 80% confidence
Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
Content: Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.
md
- **The three job-change filters stay in every search URL.** (`infra/models/new-hires.ts`) Recently changed jobs, under a year at the company, under a year in the position. Remove one and internal promotions at long-tenured employees flood in, read as new hires, and fill the channel with people who have been at the company for a decade. - **Enrich the company first, and stop when there is no domain.** (`infra/plays/route-new-hires.ts`) A Sales Navigator lead has a company URL, not the firmographics the qualifier judges on. A company

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The line states that the buying committee 'must operate in English,' which is a natural-language locale constraint. The file does not offer a language choice, user opt-in, or a documented region-specific justification for this restriction, so it appears to violate the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.
md
when a CRM is connected, say what each adds and what it costs before writing either. | Variation | What it adds | What it costs | | ------------- | ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | `crm_lookup` | One read-only line on the Slack post: already in the CRM or not, its stage, and its owner | A CRM connector and one lookup per qualified person. Nothing is written | | `crm_routing` | The CRM becomes the destination: account, contact and an owner's task, routed on what the CRM already holds | Owner IDs, a CSM field, association types and a LinkedIn field to resolve; an email lookup per person; the CRM writes are irreversible |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/crm-adaptation.md (reported line 8)May include surrounding context.
md
when a CRM is connected, say what each adds and what it costs before writing either. | Variation | What it adds | What it costs | | ------------- | ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | `crm_lookup` | One read-only line on the Slack post: already in the CRM or not, its stage, and its owner | A CRM connector and one lookup per qualified person. Nothing is written | | `crm_routing` | The CRM becomes the destination: account, contact and an owner's task, routed on what the CRM already holds | Owner IDs, a CSM field, association types and a LinkedIn field to resolve; an email lookup per person; the CRM writes are irreversible |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/crm-adaptation.md (reported line 8)May include surrounding context.
md
when a CRM is connected, say what each adds and what it costs before writing either. | Variation | What it adds | What it costs | | ------------- | ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | `crm_lookup` | One read-only line on the Slack post: already in the CRM or not, its stage, and its owner | A CRM connector and one lookup per qualified person. Nothing is written | | `crm_routing` | The CRM becomes the destination: account, contact and an owner's task, routed on what the CRM already holds | Owner IDs, a CSM field, association types and a LinkedIn field to resolve; an email lookup per person; the CRM writes are irreversible |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/crm-adaptation.md (reported line 168)May include surrounding context.
md
The CRM replaces Slack as where the hand-off lands, and the same job-change event means different things depending on what it already holds: | The account is… | What the play does | | ------------------------------ | --------------------------------------------------------------------------------------------------- | | Not in the CRM | Qualifies it. If it fits: creates the account, the contact, and a task for the named owner | | In the CRM, open deal | Adds the contact and a HIGH task for the owner: a new decision-maker mid-deal |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/crm-adaptation.md (reported line 185)May include surrounding context.
md
What it asks for, on top of the template's inputs: | Input | Kind | How it is answered | | ------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm` | derived | Inspect the authenticated connectors. If more than one CRM is connected, ask which one is the system of record | | `new_account_owner` | asked | Pick from the CRM's live owner list (HubSpot owners, Salesforce users, Attio members) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/crm-adaptation.md (reported line 187)May include surrounding context.
md
| Input | Kind | How it is answered | | ------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm` | derived | Inspect the authenticated connectors. If more than one CRM is connected, ask which one is the system of record | | `new_account_owner` | asked | Pick from the CRM's live owner list (HubSpot owners, Salesforce users, Attio members) | | `person_dedupe` | asked | One contact per person (default: a mover's record is moved) or a new contact per company | | `csm_owner_field` | derived | The company property holding the CSM as an owner, from the live schema. Ask only when none is obvious |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/crm-adaptation.md (reported line 188)May include surrounding context.
md
| Input | Kind | How it is answered | | ------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm` | derived | Inspect the authenticated connectors. If more than one CRM is connected, ask which one is the system of record | | `new_account_owner` | asked | Pick from the CRM's live owner list (HubSpot owners, Salesforce users, Attio members) | | `person_dedupe` | asked | One contact per person (default: a mover's record is moved) or a new contact per company | | `csm_owner_field` | derived | The company property holding the CSM as an owner, from the live schema. Ask only when none is obvious | | `routing_signal` | derived | HubSpot: confirm `lifecyclestage` is populated on companies. Salesforce: the opportunities. Attio: the deal stage or a status attribute |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/crm-adaptation.md (reported line 189)May include surrounding context.
md
| ------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `crm` | derived | Inspect the authenticated connectors. If more than one CRM is connected, ask which one is the system of record | | `new_account_owner` | asked | Pick from the CRM's live owner list (HubSpot owners, Salesforce users, Attio members) | | `person_dedupe` | asked | One contact per person (default: a mover's record is moved) or a new contact per company | | `csm_owner_field` | derived | The company property holding the CSM as an owner, from the live schema. Ask only when none is obvious | | `routing_signal` | derived | HubSpot: confirm `lifecyclestage` is populated on companies. Salesforce: the opportunities. Attio: the deal stage or a status attribute | | `contact_key` | derived | The contact field holding a LinkedIn URL. Use the one the project's other cookbooks use (crm-deduplication reads `linkedin_url`); check the stored shape is one of the four forms the lookup searches |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/crm-adaptation.md (reported line 190)May include surrounding context.
md
| `crm` | derived | Inspect the authenticated connectors. If more than one CRM is connected, ask which one is the system of record | | `new_account_owner` | asked | Pick from the CRM's live owner list (HubSpot owners, Salesforce users, Attio members) | | `person_dedupe` | asked | One contact per person (default: a mover's record is moved) or a new contact per company | | `csm_owner_field` | derived | The company property holding the CSM as an owner, from the live schema. Ask only when none is obvious | | `routing_signal` | derived | HubSpot: confirm `lifecyclestage` is populated on companies. Salesforce: the opportunities. Attio: the deal stage or a status attribute | | `contact_key` | derived | The contact field holding a LinkedIn URL. Use the one the project's other cookbooks use (crm-deduplication reads `linkedin_url`); check the stored shape is one of the four forms the lookup searches | | `find_email_tool` | derived | Instantiate Cargo's native Find Email tool, confirm its live inputs and output path, and replace `REPLACE-WITH-FIND-EMAIL-TOOL-UUID` |

new-hire-detection

Overview

A.I.G

SkillSpector

Memory Manipulation

Rp1

Skill Enumeration

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Unbounded Output

Natural-Language Policy Violations

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Static analysis

Prompt-injection style instruction pattern detected.