Security audit

cazador-lead-magnets-f100k

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent marketing workflow, but it asks users to provide raw private DMs without enough privacy safeguards.

Install only if you are comfortable using it for marketing research and can control the data you provide. Before using it, redact names, handles, contact details, health or financial information, and any unrelated personal content from DMs; prefer summaries or anonymized excerpts over raw conversations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill declares very broad natural-language triggers and says to activate 'SIEMPRE', which can cause the agent to invoke this skill in contexts the user did not clearly intend. Over-broad activation is dangerous because it can override user choice, misroute tasks, and unexpectedly initiate workflows that request sensitive business data or private messages.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill operationalizes the collection of private DMs and competitor/user data through tools and asks for those messages to be supplied as workflow input. This is dangerous because it encourages ingestion of potentially sensitive personal data into the model context without minimization, consent checks, or redaction requirements.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The skill hard-codes 'español neutro' without checking the user's language preference. While not a direct security exploit, this is a policy and user-control issue because it forces behavior the user did not opt into and can degrade trust or cause misleading outputs in multilingual or locale-sensitive contexts.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The method makes verbatim DMs from the last 30 days a mandatory input. Requiring literal private-message content increases the chance of exposing confidential customer information, regulated personal data, or third-party communications that were never intended for model processing.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The workflow explicitly tells the user to paste DMs verbatim and suggests using other skills/tools to extract them, reinforcing a repeatable pipeline for collecting private conversations. The surrounding context makes this more dangerous because the skill is designed for operational use and file output, so sensitive data can propagate across tools, chats, and stored deliverables.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The absolute restriction against a specific language variant removes user choice and can conflict with explicit user instructions. This is risky from a safety/governance perspective because rigid style rules can cause the assistant to ignore legitimate user preferences and mask that the skill is prioritizing internal constraints over user intent.

Static analysis

No suspicious patterns detected.