Security audit

BigLead · 精准客户线索挖掘（找客户·销售线索·客户开发·联系方式）| B2B Lead Generation & Prospecting

Security checks for vulnerabilities and agentic risk

Overview

BigLead is a coherent B2B lead-management skill, but its broad activation and under-scoped export behavior create review-worthy privacy and file-overwrite risk.

Review this skill before installing if you handle sensitive prospect lists. It is meant to save and export business lead data locally, so use it only where that persistence is acceptable, avoid opening exported CSVs from untrusted imported data in spreadsheets, and do not let untrusted prompts choose export paths.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/biglead.py:188
Finding: CSV Formula Injection in Exported Lead Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/biglead.py:188
Finding: Arbitrary Writable File Overwrite Through the Export Path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill markets itself as performing search, cross-validation, and contact extraction, but the described implementation is primarily local database management. This mismatch can mislead users and orchestrators about what the skill actually does, causing unsafe trust assumptions, unexpected data handling, or overbroad invocation in contexts where external collection or verification is expected.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to write lead/contact data and exports to disk, but it does not declare any tool scope such as permissions or allowed-tools. That creates an authorization gap where file-writing behavior is implicit rather than transparently bounded, increasing the chance of unintended persistence of sensitive business contact data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are generic sales-language terms such as '找客户', 'leads', and 'list', which can match many ordinary conversations. Overly broad activation increases the risk that the skill runs unintentionally and starts collecting, storing, or exporting lead/contact data without the user clearly intending to invoke this workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill specifies mandatory storage of leads, search history, and exports on disk, but it does not present a prominent upfront warning or consent mechanism to users. Because the stored data includes business contact details and activity history, silent persistence can create privacy, compliance, and data-retention risks if users are unaware that collection results are being saved locally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The export command writes lead records including phone numbers, email addresses, addresses, and notes directly to a CSV file with no consent check, access control, masking, or warning about handling personal/business contact data. In a lead-generation skill, this increases the risk of unauthorized disclosure, bulk exfiltration, or accidental sharing of sensitive prospect information, especially because CSVs are easy to redistribute and open in other tools.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: Most operational instructions, trigger phrases, examples, and output formats are written only in Chinese, and the examples imply Chinese-language use as the default interaction mode. There is no explicit statement that users may choose another language or locale for operation/output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language interface and usage instructions are entirely in Chinese, and the CLI descriptions/help text throughout the file are also Chinese-only. This imposes a specific language/locale without any opt-in or documented justification, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.