Instantly AI Integration

• Outcome: Review
• Latest audit: Sep 20, 2026 · 11:47 AM UTC
• Version: 2.0.5

Overview

This skill is a real Superagnt/Instantly API integration, but it exposes powerful workspace administration, credential, billing, and destructive account operations beyond ordinary outreach workflows.

Review this skill before installing. Use it only in a workspace where the agent is allowed to administer Instantly, not just manage campaigns. Treat API key creation/deletion, workspace membership changes, ownership transfer, webhook setup, mailbox password handling, email actions, and bulk delete operations as requiring explicit human approval.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: API key creation and deletion are privileged security operations that exceed the stated outreach purpose and can be abused to establish persistence, expand access, or disrupt legitimate integrations. An agent with access to these functions could mint new credentials for unauthorized future access or revoke existing keys to cause denial of service.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Workspace member and group administration enables adding, modifying, or removing users and access relationships, which is unrelated to ordinary outreach execution. In an agent setting, these capabilities materially increase the blast radius of prompt injection or accidental invocation by allowing privilege changes and unauthorized access provisioning.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documented ability to change workspace ownership is a highly sensitive administrative action unrelated to normal outreach automation. If an agent can invoke this operation, a prompt injection or user misunderstanding could permanently transfer control of the workspace to another party, leading to account takeover and loss of administrative control.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill is presented as an outreach-management integration, but its documented surface area includes far broader capabilities such as workspace administration, API key management, and billing access. This scope mismatch can mislead users and agents into granting or invoking powerful actions they would not reasonably expect from a campaign/lead skill, increasing the chance of privilege misuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documentation describes handling API keys, mailbox credentials, email content, and account connections, but does not include a privacy or security warning about transmitting and storing sensitive credentials and communications. This omission can cause users or downstream agents to treat highly sensitive data as routine input, increasing risk of credential leakage and privacy violations.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Verify the install (do this first)

```bash
curl -s https://api.superagnt.com/v1/credits \
  -H 'Authorization: Bearer $SUPERAGNT_API_KEY'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Verify the install (do this first)

```bash
curl -s https://api.superagnt.com/v1/credits \
  -H 'Authorization: Bearer $SUPERAGNT_API_KEY'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Verify the install (do this first)

```bash
curl -s https://api.superagnt.com/v1/credits \
  -H 'Authorization: Bearer $SUPERAGNT_API_KEY'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill exposes many destructive or high-impact operations such as delete, move, pause, ownership, membership, and key-management actions without any caution section or execution safety guidance. In an agent context, the absence of warnings and confirmation requirements increases the likelihood of accidental destructive actions or socially engineered misuse.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Billing and subscription inspection is outside the stated outreach-management scope and exposes potentially sensitive financial and account-plan information. While less severe than credential or ownership operations, it still broadens data exposure and can aid reconnaissance about the organization and service entitlements.

Static analysis

No suspicious patterns detected.