LeadsDaddy B2B Lead Finder

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 1.0.1

Overview

This is a coherent LeadsDaddy B2B prospecting skill, but users should treat it as an external paid-service integration.

Install only if you trust LeadsDaddy and the @leadsdaddy/mcp npm package. Use a least-privileged LeadsDaddy token, avoid sharing confidential customer data unless authorized, confirm any lead-unlock costs, and prefer reviewing leads before allowing unlock actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party MCP Package Installed Globally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–23 and 49–53
Vulnerability Type: Unpinned third-party dependency with global installation
Risk Level: Medium

Vulnerable Code

Lines 17–23:

json

"install":
  [
    {
      "id": "node-leadsdaddy-mcp",
      "kind": "node",
      "package": "@leadsdaddy/mcp",
      "bins": ["leadsdaddy-mcp"],
      "label": "Install LeadsDaddy MCP (npm)",
    },
  ],

Lines 49–53:

markdown

Before using this skill, make sure LeadsDaddy MCP is installed and configured:

```bash
npm install -g @leadsdaddy/mcp

text

### Technical Analysis

The skill instructs users to install and execute the mutable latest version of the third-party npm package `@leadsdaddy/mcp`. It does not specify an exact audited version, integrity hash, lockfile, or other mechanism that would ensure the installed artifact is the same one that was reviewed.

The `-g` option installs the package globally. npm package installation can execute lifecycle scripts, while the installed `leadsdaddy-mcp` binary subsequently runs with the permissions of the invoking account. The package is also expected to receive the `LEADSDADDY_TOKEN` environment variable during operation.

No source code for `@leadsdaddy/mcp` is included in the audited project, so its installation behavior, lifecycle scripts, token handling, and runtime behavior cannot be independently verified from this repository. There is no evidence in the reviewed file that the package is currently malicious; the vulnerability is the uncontrolled supply-chain trust boundary.

### Attack Path

1. An attacker compromises the npm publisher account, package repository, build pipeline, or another upstream distribution component for `@leadsdaddy/mcp`.
2. The attacker publishes a malicious release under the same package name.
3. A user follows the documented `npm install -g @leadsdaddy/mcp` command, which resolves the m
...[truncated 1355 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @leadsdaddy/mcp to an exact reviewed version rather than relying on the mutable latest release.
2. Record and verify the package's expected integrity digest through a lockfile or equivalent package-integrity mechanism.
3. Prefer a project-local installation over npm install -g so dependency resolution is reproducible and the executable is scoped to the project.
4. Review the package source, transitive dependencies, published artifact contents, and npm lifecycle scripts before approving a version.
5. Disable npm lifecycle scripts during installation where compatible, and explicitly run only reviewed setup steps.
6. Execute the MCP server as a dedicated, unprivileged account or inside a sandbox with restricted filesystem and network access.
7. Provide the MCP server only the environment variables it requires. Avoid inheriting unrelated credentials from the parent process.
8. Scope LEADSDADDY_TOKEN to the minimum necessary permissions, rotate it regularly, and revoke it immediately if package compromise is suspected.
9. Document an approved package version and upgrade-review process so new releases are not installed automatically without security validation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs users to configure API credentials and unlock paid leads, but it does not clearly disclose that prospecting inputs and lead-review activity are sent to a third-party service and may have billing, privacy, or compliance consequences. In a lead-generation context, users may submit customer lists, target geographies, or business intelligence without realizing those data leave the local environment or that unlocking can incur cost.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

- generate leads for packaging, restaurant supply, foodservice, industrial, or other B2B verticals
- review task output and decide which leads are worth unlocking

This skill is **global by design**. It is not limited to one country or one market.
It can be used for North America, Europe, the Middle East, Southeast Asia, Latin America, Africa, and other markets wherever LeadsDaddy has useful coverage.

## Preconditions

Static analysis

No suspicious patterns detected.