Security audit

SpecQ Intel Sales

Security checks for vulnerabilities and agentic risk

Overview

The skill’s sales-intelligence purpose is mostly coherent, but it exposes under-disclosed local database, arbitrary URL, third-party processing, and persistent memory capabilities that users should review carefully before installing.

Install only if you are comfortable with a local MCP server storing sales/customer data in persistent local memory and, when configured with API keys, sending search, embedding, or transcription content to external services. Avoid giving it sensitive databases or arbitrary internal URLs unless you have reviewed and constrained those capabilities; the package should ideally add explicit permission disclosure, source allowlists, redaction enforcement, and memory deletion controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (48)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no permissions, yet its documented behavior implies access to environment variables, local file read/write, and optional network access. This creates a transparency and consent gap: users and host agents may not understand the real data access surface, especially given the skill handles sensitive customer intelligence and persists it locally.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose is narrowly framed as sales intelligence generation, but the behavior described by analysis is materially broader: persistent arbitrary memory, working-plan management, local media ingestion/transcription, SQLite querying, arbitrary remote URL access, and analytics logging. That mismatch is dangerous because it can conceal a much larger attack and privacy surface than users expect, particularly around local data exfiltration and over-collection of sensitive customer information.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims customer real names will be excluded, but its own examples and workflow show named customers in output memory blocks. This inconsistency can lead to accidental disclosure of confidential customer identities in generated output, logs, or shared artifacts, undermining the stated privacy guarantees.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The FAQ asserts that no data is uploaded to third-party servers, yet the documentation also describes optional external APIs for web search and embeddings. This is a misleading data-handling statement that may cause users to share sensitive sales or customer data under false assumptions about where it can be transmitted.

Description-Behavior Mismatch

High

Confidence: 92% confidence
Finding: The design materially expands the skill from a sales-intelligence generator into a general data-ingestion and retrieval agent by adding internet search, memory, multimodal intake, and external/local data access. That broader capability increases attack surface and data-handling risk beyond the declared purpose, making misuse and unreviewed data flows much more likely in an enterprise sales context.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: Adding OCR, audio transcription, and video processing introduces collection of potentially sensitive personal, customer, and bystander data without a clear necessity tied to the stated skill purpose. In a sales-intel workflow, these modalities can capture far more data than the user expects and create privacy, consent, and retention risks.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The design executes caller-supplied SQL against a caller-supplied local SQLite path, effectively exposing arbitrary local data access through the skill. Even if limited to SQLite, this enables unauthorized reading of local databases and turns a sales-intel tool into a generic local data exfiltration interface.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Allowing requests to arbitrary caller-specified api_url values creates a general outbound network primitive unrelated to the skill's purpose. This can be abused for data exfiltration, access to internal services if deployed in a trusted environment, and bypass of normal integration review.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The document claims exceptions should not be silently swallowed, yet many new code paths use broad try/except with pass. This undermines auditing and safety controls by hiding failures in search, multimodal processing, anonymization, and memory writes, making privacy or security failures invisible.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The design extends a sales-intel skill into user tracking, usage analytics, and conversion-funnel measurement tied to user identifiers and business outcomes. That creates a privacy and purpose-creep risk because the collected telemetry goes beyond the core function of generating intel packages and may capture sensitive behavioral and commercial performance data without clear consent boundaries.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Allowing caller-supplied db_path, db_query, api_url, and api_params enables arbitrary local database access and arbitrary outbound requests, which can be abused for local file discovery, unauthorized data extraction, and SSRF-like access to internal services. This is especially dangerous because the capability is broader than the stated sales-intel purpose and appears to lack path allowlisting, query restrictions, or network destination controls.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The spec claims anonymization as a built-in safeguard, yet the anonymize flag defaults to true and can be disabled, creating a direct policy-to-implementation gap. Users or downstream components may incorrectly rely on guaranteed redaction and inadvertently expose real customer identities in generated outputs.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The design states that all outputs are automatically anonymized, but elsewhere permits anonymization to be turned off, which undermines the stated privacy guarantee. This inconsistency increases the chance of accidental disclosure of customer names, contacts, or commercially sensitive information through normal use.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The `specq_extract_insights` tool accepts arbitrary `db_path`, `db_query`, and `api_url` inputs, then reads local SQLite files and fetches remote data with no allowlist, path restriction, or purpose limitation. In an MCP/agent setting this becomes a powerful data-access primitive that can be abused to exfiltrate local business data or turn the skill into a generic proxy beyond its stated sales-intelligence purpose.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This module can send arbitrary input text to a third-party embedding API, which is significant in a sales-intelligence skill explicitly handling sensitive internal materials such as visit records, lost-deal reviews, and competitor intelligence. Even if configurable and seemingly intended, this creates a real data exfiltration path to an external service without any code-level gating, classification checks, or consent flow.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The code reads API credentials from environment variables and uploads local audio files to a third-party transcription endpoint. In a sales-intelligence skill that may process visit notes, customer conversations, or competitive information, this creates a real data-exfiltration and privacy risk if users are not explicitly informed and the remote service is not tightly controlled.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: An overly broad trigger phrase can cause the skill to activate on ordinary conversation and begin recall, plan recovery, or data-writing workflows unexpectedly. In this skill, accidental activation is more concerning because it operates on persistent memory containing sensitive customer and sales intelligence.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Using 'any one set of information can trigger' without tight boundaries broadens the activation surface and increases the chance of unintended handling of user content. Because the skill may automatically query memory, generate intelligence, or persist records, ambiguous triggering can expose or store sensitive information without sufficiently clear user intent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The workflow describes automatic writes to local long-term memory and customer-data storage, but lacks a prominent upfront notice or consent step. This is dangerous in context because the stored content includes visit records, loss reasons, preferences, and potentially identifiable customer intelligence, creating privacy, compliance, and retention risks.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The multimodal workflow processes images, audio, and video without any user-facing consent, warning, or privacy disclosure. In practice this can collect sensitive customer information, voices, faces, and incidental data that users may not realize will be extracted and stored.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The design automatically stores visit content into long-term memory without clearly notifying users that their input will persist and be reused. In a sales setting, visit notes often contain confidential customer details, competitive intelligence, and personal data, so silent persistence materially increases confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill adds online search and third-party API use without warning users that queries and related context may be sent to external services. Because sales queries can include customer names, products, and competitive context, this creates an avoidable disclosure channel to outside providers.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The design stores visit notes, feedback, generated intel, and user preferences in long-term memory, yet the skill description does not warn users that their content will be retained. This creates a meaningful privacy and compliance risk because the retained data may include customer identities, internal sales history, and sensitive business judgments.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The spec introduces web search and external media-processing flows for OCR, speech, and video handling without warning users that their inputs may be transmitted to third-party services. Because those inputs may contain customer data, contact details, or confidential visit content, silent transmission materially increases confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The design allows local database reads and remote API access without corresponding user-facing warnings, so users may not understand that the skill can touch local data sources or contact arbitrary remote endpoints. That gap increases the risk of unintended data exposure and misuse of the tool beyond expected sales-intel behavior.

Static analysis

No suspicious patterns detected.