Lead Automation

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill is not malware, but it automates lead scraping and email follow-ups without clear consent, opt-out, rate-limit, or approval controls.

Review before installing. Use it only for lawful, consented outreach with dedicated low-privilege API keys and sending accounts, explicit rate limits, unsubscribe and suppression handling, and human approval before scraping, publishing websites, or sending any campaign.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly describes automated lead scraping, personalized outreach, and follow-up automation without any warnings, consent requirements, or privacy/compliance guardrails. This is dangerous because it encourages collection and use of business/contact data for outreach at scale, which can violate privacy expectations, anti-spam rules, platform terms, and data protection obligations if implemented without notice, lawful basis, opt-out handling, and rate limits.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal