Searcher Os

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:15 PM UTC
• Version: 1.3.0

Overview

The skill matches its stated deal-management purpose, but it can change important business records and hide or advance deal workflow items without clear per-action user confirmation.

Review this before installing if you want every business-record change to require approval. The skill is coherent for Searcher OS users, but you should be comfortable with an agent reading sensitive deal/email/CIM data and performing some remote workflow updates without an additional confirmation prompt.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **pipeline_move_stage** — Move deal to new stage. Needs confirmation. Params: `opportunity_id` (uuid), `new_stage` (enum)
- **pipeline_add_note** — Add note to deal. Params: `opportunity_id` (uuid), `notes` (string)
- **pipeline_kill_deal** — Kill a deal. Needs confirmation. Params: `opportunity_id` (uuid), `kill_reason` (financial_discrepancy|deal_size_insufficient|concentration_risk|industry_mismatch|no_broker_response|overpriced|intuitive_rejection|competition|location|other), `kill_notes?`
- **pipeline_update_deal** — Update deal metadata (star, label, next action, priority). No confirmation needed. Params: `opportunity_id` (uuid), `is_starred?` (boolean), `deal_label?` (green|yellow|red|null), `next_action?` (string|null, max 500), `next_action_due?` (ISO date string|null), `priority?` (0-10)
- **pipeline_log_interaction** — Log an interaction (call, email, meeting, note) directly on a deal without needing a broker. No confirmation needed. Params: `opportunity_id` (uuid), `interaction_type` (call|email_sent|email_received|meeting|note), `subject?` (max 300), `notes?` (max 5000), `broker_id?` (uuid, optional)

### Feed (On-Market Deals)

• Confidence: 95% confidence
• Finding: The skill exposes several state-changing operations that explicitly require no confirmation, including updating deal metadata and logging interactions. In an agent setting, this enables the model to make consequential business-record changes based on ambiguous prompts, hallucinated context, or prompt injection from untrusted email/CIM content, without an explicit user approval step.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **pipeline_add_note** — Add note to deal. Params: `opportunity_id` (uuid), `notes` (string)
- **pipeline_kill_deal** — Kill a deal. Needs confirmation. Params: `opportunity_id` (uuid), `kill_reason` (financial_discrepancy|deal_size_insufficient|concentration_risk|industry_mismatch|no_broker_response|overpriced|intuitive_rejection|competition|location|other), `kill_notes?`
- **pipeline_update_deal** — Update deal metadata (star, label, next action, priority). No confirmation needed. Params: `opportunity_id` (uuid), `is_starred?` (boolean), `deal_label?` (green|yellow|red|null), `next_action?` (string|null, max 500), `next_action_due?` (ISO date string|null), `priority?` (0-10)
- **pipeline_log_interaction** — Log an interaction (call, email, meeting, note) directly on a deal without needing a broker. No confirmation needed. Params: `opportunity_id` (uuid), `interaction_type` (call|email_sent|email_received|meeting|note), `subject?` (max 300), `notes?` (max 5000), `broker_id?` (uuid, optional)

### Feed (On-Market Deals)
- **feed_search** — Search on-market deals. Params: `keyword?`, `industry?` (slug), `states?` (string[]), `msas?` (string[], metro areas), `min_price?`, `max_price?`, `min_ebitda?`, `max_ebitda?`, `min_revenue?`, `max_revenue?`, `min_margin?`, `max_margin?` (0-1), `min_multiple?`, `max_multiple?`, `buy_box_id?`, `freshness_hours?`, `sort_by?` (first_seen|asking_price|sde_ebitda|gross_revenue), `sort_order?` (asc|desc), `limit?` (default 20, max 50), `offset?`

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **feed_count** — Count matching deals. Params: `keyword?`, `industry_filter?`, `states?` (string[]), `buy_box_id?`, `freshness_hours?`, `price_dropped?` (boolean), `min_price?`, `max_price?`, `min_ebitda?`, `max_ebitda?`, `min_revenue?`, `max_revenue?`
- **feed_stats** — Feed statistics (price distribution, industry/source breakdown). No params.
- **feed_save_deal** — Save deal to pipeline. Needs confirmation. Params: `staging_listing_id` (uuid), `private_notes?`
- **feed_dismiss_deal** — Dismiss deal from feed. Auto-approved by default. Params: `staging_listing_id` (uuid)

### Inbox (Inbound Emails)
- **inbox_list** — List emails. Params: `status?` (unmatched|matched|ignored), `limit?`, `offset?`

• Confidence: 88% confidence
• Finding: feed_dismiss_deal is auto-approved by default, letting the agent hide or discard candidate deals without an explicit user decision. In this M&A workflow context, silently dismissing opportunities can cause missed business opportunities and can be abused by malicious prompt content to bias or suppress results.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Tasks
- **task_list** — List tasks for deals. Returns incomplete tasks by default. Params: `opportunity_id?` (uuid, filter to single deal), `stage?` (pipeline stage filter), `include_completed?` (default false), `limit?` (default 50, max 100), `offset?`
- **task_update** — Update a task. Mark complete/incomplete, change priority, set due date, or rename (manual tasks only). Completing the last task in a stage may auto-advance the deal. No confirmation needed. Params: `task_id` (uuid, required), `completed?` (boolean), `title?` (manual tasks only, max 500), `priority?` (1=High, 2=Medium, 3=Normal, manual tasks only), `due_date?` (YYYY-MM-DD|null)

### Confirmations
Write operations may return `"status": "pending_confirmation"`. Use these tools to manage:

• Confidence: 93% confidence
• Finding: The task_update tool allows changing task state without confirmation, and the documentation notes that completing the last task may auto-advance the deal stage. That creates an indirect state-transition path where an agent can materially alter workflow status without a deliberate user approval, increasing the risk of unintended operational actions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **confirmation_list_pending** — List pending confirmations. No params.
- **confirmation_check_status** — Check status. Params: `confirmation_id` (uuid)
- **confirmation_resolve** — Approve or deny. Params: `confirmation_id` (uuid), `decision` (approved|denied)
- **confirmation_get_auto_approve** — Get auto-approve settings. No params.

## Confirmation Flow

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **confirmation_list_pending** — List pending confirmations. No params.
- **confirmation_check_status** — Check status. Params: `confirmation_id` (uuid)
- **confirmation_resolve** — Approve or deny. Params: `confirmation_id` (uuid), `decision` (approved|denied)
- **confirmation_get_auto_approve** — Get auto-approve settings. No params.

## Confirmation Flow

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.