Business Email Extractor

Security checks across malware telemetry and agentic risk

Overview

This skill openly helps collect business emails through a third-party scraper and saves results locally, with privacy and outreach-compliance caveats but no hidden or destructive behavior.

Install only if you are comfortable sending your business search targets to gmapsscraper.io, using its API key, and storing harvested email lists as local CSV files. Confirm your outreach complies with applicable email, privacy, and opt-out rules before using the results.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger phrase "find emails" is overly broad and can cause the skill to activate in contexts the user did not intend, especially because this skill performs third-party data collection for outreach. In this skill’s context, unintended activation is more concerning because the behavior involves extracting contact data for cold outreach, which can create privacy, compliance, and user-trust issues.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill sends user-specified search targets to a third-party service and writes downloaded results to a local CSV, but the description does not prominently warn about this data transmission and storage. That omission reduces informed consent and can expose sensitive commercial targeting information or harvested contact data without the user clearly understanding where data goes or how it is retained.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal