T09 · Insecure Skill Coding Practices
- Location
SKILL.md:44- Finding
Unconfirmed External Synchronization of Prospect Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 44–46
Vulnerability Type: Unconfirmed external data synchronization and write operations
Risk Level: MediumComplete Vulnerable Snippet:
markdown For tasks spanning multiple skills (e.g. "build a prospect list and write outreach"), run each skill in sequence: Prospecting → Qualification Scoring → Outbound Strategy. When Audience Loop MCP tools are available, use them to push prospect lists, sync audiences to LinkedIn Ads or Smartlead, and pull campaign analytics.Technical Analysis
The skill instructs the agent to use available Audience Loop MCP tools to push prospect lists and synchronize audiences with external services. It does not require explicit, operation-specific user approval before those external write operations.
A routine research or drafting request may therefore progress from locally generating a prospect list to transmitting prospect or contact information and changing audiences in LinkedIn Ads or Smartlead. The phrase “when ... tools are available, use them” makes tool availability—not informed user authorization—the condition for performing the operation.
This is an insecure skill configuration because external writes should be separated from local analysis and protected by a confirmation boundary. The instruction also lacks requirements to preview affected records, minimize transmitted fields, identify the destination account, or verify that the user is authorized to modify it.
Attack Path
- A user asks the agent to build a prospect list or perform a related GTM task.
- The skill collects or derives company, persona, and contact information.
- Audience Loop MCP tools are available in the agent environment.
- Following the skill instruction, the agent pushes the list or synchronizes it with LinkedIn Ads or Smartlead.
- Data leaves the local interaction or an external audience is modified without a distinct confirmation covering the destination ...[truncated 1063 chars]
- Remediation
View remediation
Remediation Suggestions
- Default every research, scoring, and drafting workflow to local output only.
- Require explicit user confirmation immediately before each external upload, synchronization, campaign modification, or analytics retrieval.
- Present a preview containing:
- Destination service and account.
- Operation type.
- Number and identity of affected records.
- Fields that will be transmitted.
- Expected external changes.
- Separate read-only analytics operations from write operations and request only the minimum necessary permissions.
- Apply data minimization and exclude sensitive or unnecessary personal information.
- Validate that records are verified and within the user-approved targeting criteria before synchronization.
- Provide a dry-run mode and preserve an auditable record of authorization and changes.
- Replace the unsafe instruction with language such as:
markdown When Audience Loop MCP tools are available, do not push prospect lists, synchronize audiences, modify campaigns, or retrieve account analytics unless the user explicitly requests that specific operation. Before any external action, show the destination, affected records and fields, and expected changes, then obtain confirmation.