Cold Outreach — Free Methodology

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:42 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent cold-email guide, but it enables broad automated outreach and storage of contact data without enough compliance, consent, credential, or approval safeguards.

Review this skill before installing if you plan to let an agent execute it. Use it only with contacts you are allowed to process and email, honor opt-outs immediately, keep suppression lists current, restrict Google Sheet sharing, store Gmail/n8n credentials only in secure credential stores, and require human approval before importing lead lists or sending any outbound sequence.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill provides step-by-step guidance for sourcing leads, sending cold emails, automating follow-ups, and handling replies, but it does not include clear safeguards around consent, lawful basis, privacy compliance, platform terms, or anti-spam obligations. That omission can enable misuse for unsolicited outreach at scale, expose personal data processing risks, and increase the chance of spam, complaints, account suspension, or regulatory violations.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The description grants a very broad operational mandate: it can source leads, construct email sequences, handle replies, and manage suppression lists without defining clear invocation boundaries or approval checkpoints. In an agent setting, this overbroad scope can enable the skill to autonomously perform sensitive outreach actions, including contacting third parties and processing reply data, increasing the risk of spam, policy violations, privacy issues, or unsafe execution in contexts where only partial assistance was intended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: These instructions direct the user to collect, verify, export, and store personal business contact data without any warning about privacy obligations, lawful basis, consent requirements, or downstream data-handling risks. In a cold-outreach skill, that omission increases the chance of unauthorized processing, non-compliant use of scraped/contact data, and improper retention or sharing of personal information.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Bulk email verification

If you have a list of emails from LinkedIn or other sources without verification:
1. Go to hunter.io → Email Verifier
2. Paste email addresses (or upload CSV)
3. Hunter returns: Valid, Risky, Invalid

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The import workflow tells users to place lead data into a Google Sheet-based tracking system but does not warn that personal data will persist, may be shared with collaborators, and may remain in backups or connected add-ons. That creates a real risk of over-retention, accidental disclosure, and uncontrolled downstream access to personal contact information.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide instructs users to generate and use a Gmail App Password for SMTP automation but does not clearly state that this credential is a sensitive secret that must be stored securely and never pasted into code, workflow JSON, shared docs, or repositories. In an automation-heavy outreach setup using n8n and SMTP, users are especially likely to place credentials into configs or exports, creating a realistic risk of account compromise and unauthorized email sending.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Static analysis

No suspicious patterns detected.