T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:71- Finding
Lead-generation commands implicitly trigger bulk external outreach
- Content
View full analysis
- Remediation
View remediation
Security audit
Unloopa Api
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real Unloopa API integration, but it can automatically contact third parties, place calls, and buy phone numbers with too little user confirmation.
Review this skill before installing. Only use it if you are comfortable giving an agent authority over your Unloopa account to generate leads, send outreach emails, create or trigger voice campaigns, and buy or release phone numbers. Require explicit confirmation for recipient lists, message content, calls, campaign activation, and any paid phone-number purchase.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:91- Finding
Voice setup workflow can purchase a recurring phone number without explicit confirmation
- Content
View full analysis
0 + at least 1 phone number + at least 1 voice agent. ``` ```markdown 1. GET /quota → voice_enabled? voice_credits > 0? If voice_credits=0 → share purchase_links.voice_credits 2. GET /phone-numbers → count > 0? (max 3) If empty → POST /phone-numbers/search + POST /phone-numbers/buy 3. GET /voice/agents → count > 0? (max 3) If empty → POST /voice/agents (create one) 4. POST /voice/call → single call, OR: 5. POST /voice/campaigns → bulk campaign (starts as draft) 6. PATCH /voice/campaigns/{id} → action=activate, then action=trigger ``` ```markdown ### POST /phone-numbers/buy Purchase a phone number. Pro plan required. $1/month per number. **Body:** `{ "phone_number": "+13055551234" }` Must be E.164 format from search results. **Response:** `{ number: { id, phone_number, area_code, monthly_cost_cents, created_at } }` ``` ### Technical Analysis The voice workflow treats the absence of an existing phone number as a condition for immediately searching for and purchasing one. The purchase creates a resource documented as costing `$1/month`, but the workflow does not require the agent to: - Present the selected number to the user. - Explain that the charge is recurring. - Obtain explicit purchase authorization. - Confirm the billing account or cancellation implications. - Distinguish a request to discuss or configure calling from authorization to incur a charge. Quota and plan checks establish technical eligibility but do not constitute informed financial con ...[truncated 1579 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill facilitates automated lead scraping, website generation, outreach emails, and voice calls, but it does not prominently require user warnings or consent checks before actions that affect third parties. In this context, missing safeguards can lead to spam, unsolicited calls, privacy issues, and potentially unlawful outreach at scale.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md --- ### DELETE /outreach/templates/{id} Delete a custom template. ---
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md --- ### DELETE /phone-numbers/{id} Release a phone number. Pro plan required. **Response:** `{ success: true }`
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md --- ### DELETE /voice/agents/{id} Delete a voice agent. Also removes from ElevenLabs. ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description is extremely broad: it invites use whenever a user wants to find leads, generate websites, send emails, or make voice calls. That increases the chance the agent will invoke this skill for loosely related requests and perform high-impact external actions against third parties without sufficiently narrow user intent or confirmation.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 97% confidence
- Finding
The /command endpoint is documented to automatically run an end-to-end pipeline including scraping, website generation, email enrichment, and outreach sending. This bundles multiple consequential actions into a single natural-language request, reducing human review and making accidental or unauthorized third-party contact much more likely.
- Content
Endpoints Reference
POST /command
Submit a natural language lead generation command. The API automatically runs the full pipeline: scrape → generate websites → enrich emails/socials → send outreach. No need to mention each step in the command.
Body:
json
Static analysis
No suspicious patterns detected.