AI Cold Outreach System

• Outcome: Review
• Latest audit: May 29, 2026 · 9:34 PM UTC
• Version: 1.0.0

Overview

This is a transparent cold-outreach automation skill, but it needs Review because it can collect prospect emails, use paid API keys, and add people to outbound campaign systems with weak approval and compliance guardrails.

Install only if you intentionally want an agent to help run cold outreach. Use dedicated limited-scope API keys, avoid command-line secrets, keep sequences paused by default, review lead lists and copy before importing or sending, set strict batch and credit limits, and confirm privacy, anti-spam, unsubscribe, suppression-list, and client-confidentiality requirements before running campaigns.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to use shell commands, environment variables, and local files, but it does not declare any permissions or boundaries for those capabilities. That can cause an agent platform to grant or infer broader access than users expect, increasing the chance of unauthorized command execution, file modification, or credential handling during outreach workflows.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The description uses very broad activation language such as using the skill whenever setting up cold outreach, finding emails, building sequences, or managing campaigns. In an agentic system, that can trigger the skill in loosely related contexts and lead to unintended prospecting actions, API use, or handling of sensitive business/contact data without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill tells users to export API keys in the workspace and optionally store them in JSON without any warning about secret sensitivity, safe storage, or exposure risks. In practice, this can lead to credentials being left in shell history, checked into repositories, written to shared workspaces, or exposed to other tools and agents with environment/file access.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The reference explicitly documents email enrichment and prospect import workflows that transmit personal contact data to third-party services, but it provides no warning about privacy, consent, lawful basis, or safe handling of personal data. In a cold outreach skill, this omission increases the chance that an agent or operator will collect and process email addresses in a way that violates internal policy, platform rules, or privacy regulations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation describes activating sequences without warning that this changes live campaign state and can begin outbound email sending to real prospects. In a cold outreach automation context, an agent could trigger production sends unintentionally, causing spam, reputational damage, compliance issues, or unauthorized customer contact.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The template explicitly normalizes collecting a recipient's email, researching their company, personalizing the message, and queueing delivery without any disclosure of lawful basis, consent, opt-out handling, or privacy notice. In a cold outreach skill, this materially increases the risk of privacy-law violations and deceptive outreach practices because operators may use personal/business data at scale without transparency or compliance controls.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Accepting an API key via --api-key can expose the secret through shell history, process listings, job control logs, and monitoring tools on multi-user or managed systems. In an agent skill used for outreach automation, this is more concerning because it is likely to run in shared CI, containers, or operator environments where secrets hygiene matters.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Enrich Person (get email)
```
POST https://api.apollo.io/api/v1/people/match
```
**Body:** `{"id": "apollo_person_id"}`

• Confidence: 84% confidence
• Finding: This endpoint is specifically used to enrich a person record and retrieve an email address from a third-party provider, which involves external transmission and processing of personal data. In the context of a cold outreach skill, documenting this operation without privacy, consent, or purpose-limitation safeguards makes misuse materially more likely than a generic API reference would.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Bulk Enrich
```
POST https://api.apollo.io/api/v1/people/bulk_match
```
**Body:** `{"details": [{"first_name": "X", "last_name": "Y", "organization_name": "Z"}]}`

• Confidence: 82% confidence
• Finding: The bulk enrichment endpoint sends identifying data such as first name, last name, and organization name to a third party at scale, which amplifies privacy and compliance risk. Because this skill is designed for high-volume cold outreach, the context makes mass external transmission of prospect data more dangerous than a standalone developer example.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.