Security audit
Security checks for vulnerabilities and agentic risk
This RevOps skill is a non-executable guidance package; its CRM, Slack, and ad-tech automation examples are purpose-aligned but need normal privacy and admin review before use.
Before installing or using this skill to implement workflows, review any CRM, Slack/email, enrichment, and advertising automations with the relevant system owner. Limit notifications to need-to-know recipients, avoid sending full behavioral histories into chat or email when a CRM link will do, and verify consent, opt-outs, and jurisdictional rules before syncing contacts to ad platforms.
The manifest description says to use the skill when the user wants help with revenue operations and also for 'anything involving the systems and processes that connect marketing to revenue.' That scope is broad and lacks clear exclusion boundaries or negative examples, increasing the chance of unintended invocation for general sales, marketing, or operations requests.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Deal Size | Approval Required |
|-----------|-------------------|
| Standard pricing | Auto-approved |
| 10-20% discount | Sales manager |
| 20-40% discount | VP Sales |
| 40%+ discount or custom terms | Deal desk review |
The eval explicitly expects the skill to trigger on 'casual phrasing' such as a vague complaint about pipeline issues, which broadens activation criteria beyond clearly bounded RevOps intents. Overly broad triggers can cause misrouting, where unrelated business or operational requests are incorrectly handled by this skill, reducing reliability and potentially surfacing inappropriate process guidance in the wrong context.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
1. Send internal email to contact owner: "SLA warning: [Contact Name] has not been contacted"
2. If still no activity after 24 hours → send alert to sales manager
3. If still no activity after 48 hours → reassign contact owner via rotation
4. Create task for new owner: "Urgent: Contact [Contact Name] — reassigned due to SLA breach"
**Outcome:** No MQL goes unworked for more than 48 hours
**Notes:** Exclude contacts where last activity type is "Call" or "Meeting" (already engaged)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
1. Send internal email to contact owner: "SLA warning: [Contact Name] has not been contacted"
2. If still no activity after 24 hours → send alert to sales manager
3. If still no activity after 48 hours → reassign contact owner via rotation
4. Create task for new owner: "Urgent: Contact [Contact Name] — reassigned due to SLA breach"
**Outcome:** No MQL goes unworked for more than 48 hours
**Notes:** Exclude contacts where last activity type is "Call" or "Meeting" (already engaged)
The playbook instructs sending meeting details, recent page views, and content downloads to internal recipients without any minimization, access-control, or privacy guidance. Even in a RevOps context, broad internal sharing of engagement and meeting-context data can expose sensitive personal or behavioral data to unnecessary audiences and increase compliance risk.
The daily digest recipe distributes pages visited, content downloaded, and email engagement data to owners without any warning about sensitivity, need-to-know access, or lawful-use constraints. This can normalize mass internal redistribution of behavioral tracking data and create privacy, insider exposure, and regulatory issues.
Posting enriched lead data to a Slack channel increases internal exposure of potentially sensitive personal and company information, especially when enrichment sources add firmographic or contact attributes. Without warnings about channel membership, retention, and minimization, the workflow can leak more data than is necessary for triage.
Automatically adding leads to Facebook/Google retargeting audiences based on score thresholds raises consent, transparency, and ad-tech data-sharing concerns. In a RevOps playbook, this is contextually plausible but still risky because it operationalizes cross-tool advertising sync without mentioning legal basis, opt-out handling, or jurisdictional restrictions.
No suspicious patterns detected.