Security audit

people-search

Security checks for vulnerabilities and agentic risk

Overview

This people-search skill is purpose-aligned overall, but it asks agents to install unpinned software, persist MCP configuration, and invoke mutable remote tools with too little containment.

Review this before installing. Only use it if you are comfortable with Lessie receiving search terms, company data, social handles, and contact identifiers, and prefer pinning package versions or installing manually. Do not allow automatic global installs or persistent MCP configuration changes unless you explicitly trust the publisher and the Lessie account scope.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:27
Finding: Automatic Execution of Unpinned npm Packages
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: references/cli-reference.md:78
Finding: Dynamic Remote Tool Discovery Permits Unreviewed Capability Invocation
Content: View full analysis
--args '{"key":"val"}' # Call any tool by name with raw JSON arguments ``` **`lessie tools`** fetches the latest tool list directly from the remote server. Each tool entry includes: - Tool name (the identifier you pass to `lessie call`) - Description - Full input schema (`properties`, `required` fields, types, defaults) **`lessie call`** bypasses the CLI shortcut commands and sends the arguments directly to the remote tool. This is useful when: - A shortcut command doesn't exist for a tool - The remote server has added new tools not yet covered by CLI shortcuts - You need to pass parameters that the shortcut doesn't expose ### Error recovery: fall back to `tools` + `call` **When a CLI shortcut command fails 3+ times** (argument errors, schema mismatches, unexpected parameters), stop retrying the shortcut and switch to the generic `tools` + `call` workflow: 1. Run `lessie tools` to fetch the **current** remote tool schema (the server may have updated parameter names or added required fields since the CLI was built). 2. Find the matching tool name (e.g., `find_people` for `lessie find-people`, `web_fetch` for `lessie web-fetch`). 3. Read its `inputSchema` to understand the exact parameter names, types, and required fields. 4. Call it via `lessie call --args '{ ... }'` using the correct schema. ``` ### Technical Analysis The documented fallback treats the remote server's current tool ...[truncated 2313 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger guidance is intentionally broad, instructing activation for nearly any mention of finding contacts, sourcing, prospecting, or research, even without explicit search intent. This can cause the skill to run in contexts the user did not intend, increasing the chance of unnecessary external calls, privacy exposure, and credit-consuming actions.
Content: No source excerpt is available for this finding.

MCP Config Access

High

Category: Agent Snooping
Confidence: 95% confidence
Finding: The skill instructs users to modify MCP configuration files in home-directory paths such as ~/.claude/mcp.json and ~/.cursor/mcp.json to add a remote server. Configuration-file modification is a privileged, persistence-affecting action that can alter future agent behavior beyond the scope of a single people-search task.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
Mode B: MCP Server

Add to your MCP config (Claude Code ~/.claude/mcp.json, Cursor ~/.cursor/mcp.json, etc.):

json
{

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
### Uninstall - **CLI:** `npm uninstall -g @lessie/cli && rm -rf ~/.lessie/` - **MCP:** Remove the `"lessie"` entry from your `.mcp.json` and `rm -rf ~/.lessie/` ## Quick start

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs use of npx @lessie/cli without a pinned version or integrity control, allowing whatever package version is current at execution time to run. In an agent context this expands supply-chain risk because a compromised or malicious upstream release could be fetched and executed automatically.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The mode-detection workflow directs the agent to auto-install software globally via npm install -g @lessie/cli if the command is missing. That exceeds simple people/company search behavior by authorizing environment modification and code installation, which can be abused or cause unintended system changes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill tells the agent to invoke OS-specific browser-opening commands (open, xdg-open, start) based on an authorization URL. Launching external applications is broader than the core search/enrichment purpose and creates a pathway for unintended navigation or command misuse if URL handling is unsafe.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
md
2. **Wait for explicit confirmation** before executing. 3. Never batch multiple credit-consuming calls without confirming the full plan first. **Exception — skip confirmation** if the user has explicitly said they don't want to be prompted (e.g., "don't ask me every time", "just do it", "skip confirmations"). In that case, proceed directly but still log what you executed and the credits spent after each call. ### CRITICAL: Report credit usage after every call

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guidance provides a confirmation example entirely in Chinese ('你是指做 AI Agent 的 Manus AI... 吗？') without indicating that the user's language preference should first be established. This can violate language/locale policy by implying or encouraging a specific language output absent user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The reference encourages enrichment of people and web fetching against remote services using personal identifiers, domains, and social handles, but provides no warning that these operations transmit potentially sensitive personal or organizational data off-box. In a people-search skill, this omission is especially risky because users are likely to process contact information and prospect data at scale, increasing privacy, compliance, and inadvertent data disclosure risks.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 89% confidence
Finding: The documentation exposes a generic mechanism to enumerate all remote tools and invoke any tool with raw JSON arguments, which weakens any intended guardrails provided by curated shortcut commands. In an agent skill focused on people/company intelligence, unrestricted fallback access is more dangerous because it can enable unreviewed remote capabilities, schema-based discovery of sensitive operations, and easier abuse if an agent or prompt is manipulated.
Content: Scanner excerpt · references/cli-reference.md (reported line 84)May include surrounding context.
bash
lessie tools # List all available remote tools with full parameter schemas lessie call <tool_name> --args '{"key":"val"}' # Call any tool by name with raw JSON arguments

lessie tools fetches the latest tool list directly from the remote server. Each tool entry includes:

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T07 · Tool Hijacking and Spoofing

SkillSpector

Vague Triggers

MCP Config Access

Mode B: MCP Server

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Chaining Abuse

Rp1

Context-Inappropriate Capability

Context-Inappropriate Capability

Autonomous Decision Making

Natural-Language Policy Violations

Missing User Warnings

Unrestricted Tool Access

Static analysis