Security audit

Cold Email

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its cold-email purpose, but it automatically directs third-party prospect research and promotes colleague-like subject-line camouflage, so users should review it before installing.

Review before installing. Use it only if you are comfortable with the agent performing external prospect/company lookups, and instruct it not to use Exa unless you approve each search. Keep subject lines truthful and clearly tied to the business context rather than making outreach appear internal or from a colleague.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 70% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
Content: Scanner excerpt · references/frameworks.md (reported line 80)May include surrounding context.
md
**Structure:** Trigger/Pain → Solution hint → Binary CTA. 1–3 sentences, no intro. **Best for:** High-velocity SDR teams. Mobile-optimized. Deliberately polarizing. Spend max 1 minute on personalization. Use industry/persona-level signals. For top-tier prospects, quote their own words from interviews — they almost always respond. ## Vanilla Ice Cream (Lavender)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The content explicitly recommends making cold email subject lines look like they came from a colleague rather than a vendor, which is deceptive impersonation-style social engineering. In the context of a cold-email skill, this is more dangerous because it operationalizes evasion of recipient scrutiny and can help users bypass normal skepticism and organizational filtering, increasing the likelihood of fraudulent or manipulative outreach.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill broadens from drafting cold emails into autonomous prospect research by instructing the agent to run external Exa searches. That creates a capability expansion beyond pure writing and can cause unreviewed outbound queries containing prospect or company identifiers, increasing privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The code documentation directs the agent to invoke a Node-based Exa CLI to search for company and prospect information. While personalization is relevant to cold emails, granting a concrete external search capability is a distinct capability not explicitly stated in the manifest, which frames the skill as writing assistance rather than autonomous prospect intelligence gathering.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to send prospect and company search terms to an external service without any user-facing notice or approval step. This can leak sensitive lead lists, targeting strategies, or confidential account names to a third party, especially in enterprise sales contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The text states that shorter, more direct sequences work better in the US and that the UK needs more insight/personality, which imposes locale-specific communication guidance in natural language. Because this file does not frame such locale adaptation as optional user choice or as a documented region-specific compliance requirement, it may conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.