prospecting

• Outcome: Review
• Latest audit: Aug 19, 2026 · 9:07 AM UTC
• Version: 1.0.3

Overview

This is a legitimate B2B prospecting skill, but it needs Review because it automatically broadens lead collection and writes prospecting learnings to cross-session memory without clear opt-in or limits.

Install only if you are comfortable with the agent creating B2B lead files from public sources and potentially expanding the search automatically. Set explicit geography/result limits, verify source terms and outreach laws, review generated call lists before use, and disable or monitor MEMORY.md/global learning updates unless you want prospecting knowledge retained across sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill states it only collects publicly visible business information, but it also instructs persistent cross-session updates via MEMORY.md. That creates a secondary retention and propagation channel for prospecting-derived data beyond the current batch, undermining the stated minimization and retention boundaries and increasing the chance of unintended reuse or leakage.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Cross-session memory modification is not necessary to complete a one-off prospecting task, yet the skill directs updates that survive the session. This expands data use beyond the original purpose and can cause prospecting-derived information to contaminate future tasks or be disclosed in unrelated contexts.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The checklist mandates 'real data only' with no fabrication, but later includes a concrete placeholder phone number in an example output. In a prospecting workflow that generates customer contact lists, this contradiction can normalize inclusion of synthetic contact data, leading downstream users to call or store fake numbers as if they were partially validated records.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The document first says placeholder phone numbers are a red flag that should cause processing to stop, but later shows a 555 placeholder as an acceptable annotated output. That inconsistency can be exploited by an agent or operator to justify passing fabricated lead data through compliance checks, undermining data integrity in sales outreach and creating operational, legal, and reputational risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The document explicitly instructs the assistant to append session-derived learnings to dated memory files and update a global MEMORY.md, creating persistent cross-session state beyond the stated lead-generation function. In a prospecting skill, this expands data retention and behavior over time without clear user consent or scope limits, which can leak business-sensitive patterns or cause unintended profile building across users and sessions.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The file claims it is not part of execution flow, but then directs concrete post-run actions to be performed after every batch. That mismatch can hide operational side effects from reviewers and users, increasing the chance that persistent writes and workflow changes occur without appropriate scrutiny or controls.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The README markets generation of enriched prospect data, rankings, and call lists but does not warn users that the skill creates structured prospecting outputs from collected business information. That omission can lead users to run the skill without understanding data-handling, outreach, and compliance implications, increasing the chance of misuse or policy violations in sales and lead-generation contexts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs generation of a coverage-report.json in the batch directory without any user-facing notice that additional artifacts will be written. Even if the report is operationally useful, silent file creation can expose search gaps, user targeting strategy, and internal heuristics in environments where outputs are expected to be limited to the requested CSV/JSON leads.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The cross-session memory update instruction creates persistent storage of session-derived information and global learning updates without warning users. In a sales prospecting context, retained learnings may encode customer strategies, geographic targeting, or derived business intelligence that persists beyond the original task and can influence future runs in opaque ways.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly directs saving enriched business profile data, including phone, address, website, inferred scale, client mix, equipment, and other profiling signals, to a persistent JSON file without any instruction to obtain user consent, minimize retention, or disclose storage behavior. In a prospecting context this creates avoidable privacy and data-governance risk because collected third-party business/contact data and derived intelligence may be retained longer than necessary or stored in insecure locations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This workflow explicitly gathers, scores, ranks, and exports business contact details into calling lists, but the referenced section contains no user-facing privacy, lawful-basis, consent, or outreach-compliance guidance. Even though the targets are businesses and some data may be publicly visible, operationalizing that data for outbound prospecting without compliance guardrails increases the risk of privacy violations, spam/telemarketing misuse, and regulatory exposure.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The instruction to share learnings across sessions via MEMORY.md creates a natural-language persistence channel for prospecting-derived business intelligence. Even if the data is public, cross-session accumulation increases retention, discoverability, and accidental disclosure risk beyond the immediate task and stated storage model.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

13. **VERIFICATION REQUIRED** — Before marking any prospect as "ready to call", confirm that the phone number was actually extracted from a live page (not a template). If the number is a placeholder or unverified, flag it explicitly: `"phone_status": "unverified_placeholder"`.
14. **PLACEHOLDER PHONE POLICY** — Output phone numbers must come from real page extraction. Any `555`, `0000`, `1234`, or similar placeholder pattern must be marked `"phone_status": "unverified_placeholder"` and **must not** be written to the `call-list.csv` dial column.
15. **OUTREACH BOUNDARY** — The generated call list is for **business-to-business contact only**. Honor "do not call" requests. Stop calling a prospect upon request and mark status as `"do_not_contact"`. Identify caller, company, and purpose on every call.
16. **DATA RETENTION** — Delete or archive prospect files when the campaign ends. Do not share raw JSON/CSV with third parties without consent.
17. **SELF-OPTIMIZATION IS MANDATORY** — The skill MUST automatically detect coverage gaps and adjust keywords/centers between search passes. Do NOT require user feedback to fix zero-result keywords or missing chain brands. Document all auto-adjustments in `candidates-raw.txt` with `[PASS-N-ANALYSIS]` markers.
18. **COVERAGE GAP REPORTING** — After all passes complete, generate a `coverage-report.json` documenting: (a) which center+keyword combinations returned zero results, (b) which auto-adjustments were applied, (c) estimated coverage percentage of target businesses in the area. This helps users assess completeness without manual review.
19. **SUBURBAN EXPANSION IS AUTOMATIC** — For cities >2M population, if initial 4-6 centers yield <50 unique prospects, auto-expand to 8-10 centers covering satellite cities. For Houston-sized markets, target 80-100+ prospects before stopping. Do NOT require user to ask for "more coverage" — the skill should self-assess and expand.

• Confidence: 89% confidence
• Finding: The skill mandates automatic search expansion, keyword changes, and coverage estimation without requiring user confirmation. In a prospecting context, this can materially broaden data collection scope, increase scraping/ToS exposure, and generate larger contact datasets than the user explicitly requested.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.