SEO Outreach Workflow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:43 AM UTC
• Version: 1.0.5

Overview

The skill is mostly a coherent SEO outreach drafting workflow, but it needs Review because its docs blur sensitive inbox operations and understate external tracker writes.

Review this before installing if you connect Google Sheets or mail-related tools. Use read-only sheets or CSV exports unless you explicitly want tracker status updates, and do not let this skill read inboxes, send email, or monitor replies; use a separate approved workflow for those actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: "Prepare outreach drafts" is a short, open-ended prompt that does not specify whether it applies to SEO outreach, a provided URL list, or a configured tracker. Without narrower phrasing or exclusion guidance, the trigger is susceptible to accidental invocation from ordinary conversation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest scopes the skill to reviewing outreach opportunities, finding contact information, generating drafts, processing opportunity lists, and preparing campaigns for manual sending. In contrast, the README states the skill can access Gmail to actually send or monitor replies, which goes beyond preparation/manual handoff into active email operations.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrase 'Run outreach' is overly broad and can match common user requests without specifying that the skill is limited to research, contact discovery, and draft generation. In agent routing systems, ambiguous activation phrases can invoke the skill in contexts where the user did not intend outreach automation, increasing the risk of scope creep or unintended handling of external data sources.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The example prompt 'Check for replies' suggests the skill can access and inspect a user's inbox, which conflicts with the earlier policy stating inbox monitoring must be handled by a separate approved workflow. In agent environments, example prompts often drive invocation behavior, so this can cause unauthorized capability expansion or user confusion about permitted data access.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: 'Check for replies' is a highly generic trigger that does not communicate any scope limitation and implies mailbox access. Because the README elsewhere says inbox monitoring belongs to a separate approved workflow, this phrase creates a dangerous routing ambiguity that could lead an agent to activate this skill for sensitive inbox-reading tasks.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger conditions are broad and include generic terms like outreach, link building, contact author, and processing spreadsheets/CSVs. Overbroad activation can cause the wrong skill to run in contexts involving sensitive contact discovery or bulk data handling, increasing the chance of unnecessary external access, privacy-invasive behavior, or unintended processing of user files. In this skill's context, accidental invocation is more dangerous because the workflow includes contact research and possible external tracker interaction.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill states it is limited to research, draft generation, and manual handoff, but it also instructs the agent to update an external tracker by marking rows as processed. That creates a scope mismatch: a user may believe the skill is read-only while it actually performs write operations against an external system. Even if the write is low impact, undocumented state changes can corrupt workflow tracking, overwrite user expectations, or be abused to make processing appear complete when it was not.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: Later documentation says the public skill stops at reviewed drafts and handoff, but earlier steps instruct mutation of an external tracker. This inconsistency is security-relevant because it obscures the true authority of the skill and weakens informed consent around external side effects. In agent systems, hidden or under-disclosed writes are dangerous because they can silently alter records, impede auditing, and trigger downstream automation based on incorrect status values.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The trigger list includes the Chinese phrase "邮件外链" alongside English triggers, which introduces language-specific activation behavior without explaining locale scope or obtaining user language preference. This can create inconsistent invocation behavior across languages and violates the requirement to avoid forced language/locale behavior without opt-in.

Static analysis

No suspicious patterns detected.