Cold Email Engine

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:31 PM UTC
• Version: 1.0.0

Overview

The skill is a real cold-email tool, but it needs Review because it overstates compliance and automation features while live sending and enrichment have weak safeguards.

Install only after reviewing the code and tightening controls: verify lawful basis and unsubscribe handling yourself, prefer dry runs first, fix suppression-list path handling, validate enrichment domains, and treat generated CSVs as untrusted data. Do not rely on the advertised CAN-SPAM/GDPR, drip, SMTP, Hunter/Apollo, Sheets, bounce, or reply-tracking claims without adding and testing those features.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/enrich-leads.js:28

Finding

Unvalidated Domains Enable Server-Side Request Forgery

Content

View full analysis

0) return emails[0]; } } catch (e) { /* skip */ } } return null; } ``` The domain is derived from CLI or CSV input without network-target validation: ```javascript const cleanDomain = domain.replace(/^https?:\/\//, '').replace(/^www\./, '').replace(/\/.*/, ''); const email = await findEmail(cleanDomain); ``` ### Technical Analysis The `domain` value used to construct outbound HTTPS URLs is controlled by the user through either the `--domain` argument or fields in an input CSV. The sanitization removes URL schemes, a leading `www.`, and paths, but it does not establish that the value is a legitimate public Internet hostname. There are no controls to reject: - Loopback hosts such as `localhost` or `127.0.0.1` - Private IPv4 ranges - IPv6 loopback, unique-local, or link-local addresses - Link-local metadata endpoints - Internal DNS names - Hostnames that resolve or re-resolve to private addresses - Explicit attacker-selected ports The request body is not returned in full, which limits direct disclosure. However, `extractEmails()` processes the response, and an email-like string found in an internal response can be printed or written to the enrichment output. The requests can also reveal service av ...[truncated 1457 chars]

Remediation

View remediation

strict syntax validation -> DNS resolution -> reject all non-public addresses -> connect only to the validated destination -> enforce timeout and response-size limits ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cold-email-engine.js:101

Finding

Untrusted Lead Data Is Written to CSV Without Formula Neutralization

Content

View full analysis

row[h] || '').join(',')); continue; } const domain = row.website || row.domain || row.url || ''; if (!domain) { lines.push(outHeaders.map(h => row[h] || '').join(',')); continue; } const cleanDomain = domain.replace(/^https?:\/\//, '').replace(/^www\./, '').replace(/\/.*/, ''); const email = await findEmail(cleanDomain); if (email) { row.email = email; enriched++; console.log(`✅ ${cleanDomain} → ${email}`); } else { console.log(`❌ ${cleanDomain} — no email found`); } lines.push(outHeaders.map(h => row[h] || '').join(',')); await new Promise(r => setTimeout(r, 1000)); // rate limit } fs.writeFileSync(output, lines.join('\n')); ``` ### Technical Analysis Lead fields such as `email`, `company`, and all enrichment columns are treated as trusted when exported. The code does not correctly quote CSV fields, escape embedded quotation marks, or neutralize spreadsheet formulas. Spreadsheet applications may interpret cells beginning with characters such ...[truncated 1710 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cold-email-engine.js:93

Finding

Relative Suppression-List Path Can Silently Disable Unsubscribe Enforcement

Content

View full analysis

e.trim().toLowerCase()).filter(Boolean)); } ``` The bundled configuration provides a relative path: ```json { "maxPerDay": 25, "delayBetweenMs": 3000, "dripDays": [3, 7], "suppressionFile": "suppression.txt", "trackingFile": "send-log.csv", "from": "Your Name ", "senderTitle": "Founder", "defaultTemplate": "Subject: {company} — quick question\n\nHi {first_name},\n\nI noticed {company} {pain_point}. We help businesses like yours fix that in under a week.\n\nWould it make sense to chat for 10 minutes this week?\n\n{sender_name}\n{sender_title}" } ``` The suppression set controls whether a lead is skipped: ```javascript const suppression = loadSuppression(); ``` ```javascript if (suppression.has(lead.email.toLowerCase())) { console.log(` ⏭️ Suppressed: ${lead.email}`); skipped++; continue; } ``` ### Technical Analysis When `config.suppressionFile` is set to `"suppression.txt"`, Node.js resolves that path relative to the process's current working directory. It is not resolved relative to `scripts/config.json` or `__dirname`. If the engine is launched from the project root or another directory, it may check a different file from the intended `scripts/suppression.txt`. If the file is absent, `loadSuppression()` silently returns an empty set and live sending continues. This is a fail-open design for a safety and compliance control. The documented claim that the suppression list is checked before ev ...[truncated 1373 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description claims compliance, enrichment, drip automation, and provider support that static analysis indicates may not actually exist. This mismatch can cause operators to trust the skill for legal compliance, suppression handling, and delivery controls that are absent or incomplete, leading to unauthorized outreach, policy violations, or unsafe deployment assumptions. In a cold-email context, overstating compliance features is particularly risky because users may rely on them to meet regulatory obligations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description claims compliance, enrichment, drip automation, and provider support that static analysis indicates may not actually exist. This mismatch can cause operators to trust the skill for legal compliance, suppression handling, and delivery controls that are absent or incomplete, leading to unauthorized outreach, policy violations, or unsafe deployment assumptions. In a cold-email context, overstating compliance features is particularly risky because users may rely on them to meet regulatory obligations.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

node scripts/cold-email-engine.js --source leads.csv --template templates/default.txt --from "Name <[e-mail]>"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

node scripts/cold-email-engine.js --source leads.csv --template templates/default.txt --from "Name <[e-mail]>"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

node scripts/cold-email-engine.js --source leads.csv --template templates/default.txt --from "Name <[e-mail]>"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

node scripts/cold-email-engine.js --source leads.csv --template templates/default.txt --from "Name <[e-mail]>"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill references environment-based secrets and outbound email delivery capabilities but does not declare an explicit tool or permission scope. That creates ambiguity about what the agent may access at runtime and can lead to unintended secret exposure or unauthorized use of email-sending functions. In a skill that automates outreach, undeclared env access is more dangerous because API keys and sender credentials are central to operation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation description is broad enough that an agent may select this skill for generic sales, prospecting, or email-related requests, even when the user did not explicitly ask for automated outreach or scraping. That can trigger collection of contact data, mass messaging workflows, or recipient tracking in situations where a narrower, safer skill should have been used. The risk is elevated here because the skill is designed for external communications at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown describes the pipeline functionally but does not clearly warn users that it performs automated outreach, website scraping for enrichment, and recipient tracking. Missing upfront disclosure can lead users or invoking agents to trigger privacy-sensitive and externally visible actions without informed approval. In this context, the danger is higher because the skill interacts with third-party recipients and processes personal/business contact data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code sends emails through Resend or SendGrid using lead email addresses and message content, which transmits user-supplied data to external services. Although the script logs activity and documents required API keys, it does not include an explicit warning or confirmation about live transmission to third-party providers or privacy impact.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/cold-email-engine.js (reported line 109)May include surrounding context.

js

// Send via Resend
async function sendResend(from, to, subject, body) {
  if (DRY_RUN) { console.log(`  [DRY] Would send to ${to}: ${subject}`); return true; }
  const res = await httpPost('https://api.resend.com/emails', {
    from, to: [to], subject, text: body
  }, { 'Authorization': 'Bearer ' + RESEND_KEY });
  const json = JSON.parse(res.data);

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/cold-email-engine.js (reported line 119)May include surrounding context.

js

// Send via SendGrid
async function sendSendGrid(from, to, subject, body) {
  if (DRY_RUN) { console.log(`  [DRY] Would send to ${to}: ${subject}`); return true; }
  const res = await httpPost('https://api.sendgrid.com/v3/mail/send', {
    personalizations: [{ to: [{ email: to }] }],
    from: { email: from },
    subject, content: [{ type: 'text/plain', value: body }]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This script performs automated lead enrichment by making external requests to target websites and then writing discovered contact data into CSV files, but it provides no notice, consent checks, minimization controls, or safeguards around handling collected personal/business contact information. In the context of a cold-email outreach skill, that omission increases the risk of privacy-law violations, improper processing of personal data, and accidental retention or redistribution of scraped contact details.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.