Foxreach

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:19 PM UTC
• Version: 0.1.1

Overview

This skill is coherent for managing FoxReach, but it deserves review because it controls live outreach data and campaigns while giving unsafe API-key examples.

Install only if you intend the agent to manage a real FoxReach workspace. Use environment variables or a secret manager for the API key, avoid pasting keys into commands or scripts, and require explicit confirmation before deletes, account changes, or starting campaigns that send email.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:26

Finding

FoxReach API Key Exposure Through Command-Line Arguments and Inline Scripts

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The invocation guidance says to use the skill for specific FoxReach tasks 'or anything related to the FoxReach API.' That catch-all phrase is ambiguous and lacks clear boundaries, which could cause unintended activation for loosely related requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly says to never hardcode API keys, but then provides example code with a literal api_key value embedded in source. Even if shown as a placeholder, this trains operators or downstream agents to place secrets directly in scripts, shell history, logs, and transcripts, increasing the chance of credential exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The one-liner shell example embeds an API key literal directly in the Python command, contradicting the stated guidance. This is dangerous because command-line literals are commonly exposed via shell history, process listings, debugging output, and agent logs, making accidental credential disclosure likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

md

| Setting | Value |
|---------|-------|
| Base URL | `https://api.foxreach.io/api/v1` |
| Auth Header | `X-API-Key` |
| Key Prefix | `otr_` |
| Rate Limit | 100 requests/minute |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-reference.md (reported line 7)May include surrounding context.

md

| Setting | Value |
|---------|-------|
| Base URL | `https://api.foxreach.io/api/v1` |
| Auth Header | `X-API-Key` |
| Key Prefix | `otr_` |
| Rate Limit | 100 requests/minute |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The delete example performs an irreversible lead deletion with no warning, dry-run, or confirmation guidance. In an agent skill context, examples are often copied directly into automations, so this increases the chance of accidental destructive actions against real customer/prospect data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The full campaign setup culminates in starting a campaign, which activates outbound email sending, but the example does not clearly warn that this triggers real outreach. In this skill's cold-email context, copied example code could immediately send messages to leads using assigned accounts, causing unauthorized outreach, compliance issues, and reputational damage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file lists multiple DELETE operations, including soft-deleting leads and deleting campaigns, templates, and email accounts, but provides no cautionary note about data loss, reversibility, or operational impact. Under the markdown-file criteria, descriptions should warn about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:44