Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed B2B lead-generation workflow, but it directs agents to mine LinkedIn networks, infer contact details, profile people, and prepare repeated outreach without enough consent or compliance guardrails.
Install only if you are comfortable with a skill that can guide collection of business contacts, infer emails, profile prospects from social activity, and draft repeated outreach. Use it only with lawful contact sources, respect LinkedIn and email-service rules, avoid private or scraped data, keep suppression/opt-out lists, and do not store more personal data than needed.
The skill collects or infers work emails, phone numbers, LinkedIn profiles, and behavioral/personality data, yet it does not warn users that it is processing personal data and creating outreach-ready dossiers. The absence of disclosure and consent cues materially increases privacy and compliance risk, especially in jurisdictions with strict rules for profiling and direct marketing.
The manifest description advertises broad activation around selling, finding customers, competitor analysis, and discovering opportunities without constraining the actions taken afterward. Because the workflow includes contact harvesting, profiling, and outreach generation, broad triggers increase the chance the skill activates in ordinary business conversations where users did not intend those higher-risk behaviors.
The trigger conditions are simple phrases with no exclusion conditions, consent checks, or scoping rules. In context, that ambiguity is more dangerous because activation can lead into competitor network mining and prospect profiling rather than just benign market research.
The workflow systematically mines competitors' salespeople, traverses their visible connections and interactions, and converts those individuals into outreach targets. Even if framed as public-data use, this is a structured harvesting strategy aimed at exploiting a rival's relationship graph, which meaningfully escalates privacy, platform-abuse, and competitive-intelligence risk.
The skill explicitly instructs collection of direct contact details and even inference of corporate email formats to generate work emails and optional phone numbers. This expands from market research into active personal-data harvesting and guessed contact generation, which can produce inaccurate personal data and facilitate unsolicited outreach.
The skill instructs the agent to compile individual-level dossiers containing names, titles, LinkedIn URLs, emails, phones, personality profiles, and tailored outreach content. Centralizing contact details with behavioral analysis increases the risk of privacy harm, inaccurate profiling, and misuse for manipulative or non-consensual solicitation.
The skill directs the agent to infer and use personality traits, communication style, interests, and decision style from prospects' social activity to tailor persuasion. That goes beyond ordinary lead qualification and creates a profiling pipeline for individualized influence, which raises privacy, consent, and misuse concerns even if sourced from public data.
The skill prescribes repeated outreach touchpoints across LinkedIn and email but does not warn users about third-party impact, consent expectations, or anti-spam obligations. That omission can normalize automated or semi-automated contact sequences that recipients did not request.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
## Overview
You are a professional B2B lead generation assistant, helping users complete the entire potential customer discovery process starting from product descriptions. You handle everything from competitor identification to personalized outreach material generation, following a structured 6-phase workflow that produces a comprehensive daily report with standardized 15-field lead records.
## Trigger Conditions