HeyReach Integration

• Outcome: Review
• Latest audit: Sep 18, 2026 · 11:39 PM UTC
• Version: 2.0.3

Overview

This is mostly a disclosed HeyReach API integration, but it also exposes sensitive Superagnt organization administration and API-key management that goes beyond normal outreach use.

Review before installing. Use this only with a Superagnt key that has the minimum needed permissions, and avoid giving an agent organization-scoped credentials unless you want it able to manage workspaces, invite users, and create or view workspace API keys. Require explicit approval before sending messages, starting campaigns, deleting leads, changing webhooks, or using any organization-management endpoint.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Organization administration features such as workspace creation, user listing, and role invitations are unrelated to the stated HeyReach outreach purpose. Bundling these capabilities into a messaging/outreach skill creates unnecessary access pathways for high-impact administrative actions, which could let an agent modify organizational structure or invite accounts without clear user intent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Workspace API key retrieval and creation are highly sensitive capabilities and are not justified by a HeyReach outreach-management skill. If exposed through a broadly usable skill, these endpoints could enable credential proliferation, lateral movement across workspaces, and durable unauthorized access well beyond normal outreach operations.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill is presented as a HeyReach outreach integration, but it also exposes broader Superagnt organization/workspace administration and API key management operations. This scope mismatch can mislead users and downstream agents into granting or invoking sensitive tenant-level capabilities they would not expect from an outreach skill, increasing the chance of privilege misuse and unauthorized administrative changes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation describes operations that can send messages, add leads, start campaigns, and otherwise alter external outreach state, but it does not warn users that these actions have real-world side effects. In an agent setting, lack of explicit warnings increases the chance of accidental mass messaging, unwanted campaign changes, or policy-violating outreach triggered by misunderstood prompts.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Verify the install (do this first)

```bash
curl -s https://api.superagnt.com/v1/credits \
  -H 'Authorization: Bearer $SUPERAGNT_API_KEY'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Verify the install (do this first)

```bash
curl -s https://api.superagnt.com/v1/credits \
  -H 'Authorization: Bearer $SUPERAGNT_API_KEY'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Verify the install (do this first)

```bash
curl -s https://api.superagnt.com/v1/credits \
  -H 'Authorization: Bearer $SUPERAGNT_API_KEY'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents destructive deletion endpoints for removing leads from lists without corresponding warnings about irreversible data changes or operational impact. In agent-driven workflows, omission of such warnings can cause unintended list corruption, loss of targeting data, or disruption of downstream campaigns.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Webhook creation and update features can transmit campaign and conversation-related data to arbitrary external URLs, but the documentation does not include any privacy or data-handling warning. This can lead users or agents to exfiltrate sensitive outreach metadata, lead information, or headers to third-party destinations without recognizing the exposure.

Static analysis

No suspicious patterns detected.