OpenMerch Contact Discovery

• Outcome: Pass
• Latest audit: Jun 8, 2026 at 6:39 PM UTC
• Version:
  1.0.2

Overview

This appears to be a purpose-aligned email-discovery skill, with the main caveat that users should understand personal data is sent to an external provider.

Before installing, confirm you are comfortable sending names and company domains to OpenMerch and that your use has a legitimate business purpose and complies with applicable privacy, anti-spam, and data-retention rules. Use your own API key and avoid submitting sensitive or non-consensual personal data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The examples normalize sending a person's name and company domain to a third-party contact-discovery provider and encourage use of a live API key, but they do not warn that this transmits personal data to an external service or discuss consent, lawful basis, or retention. In a skill specifically designed to discover work email addresses, that omission increases the chance of privacy misuse, non-compliant processing, or unsafe operator assumptions about how the data is handled.

VirusTotal

64/64 vendors flagged this skill as clean.