Security audit

Contact Finder

Security checks for vulnerabilities and agentic risk

Overview

This contact-finding skill is purpose-aligned, but it needs Review because it sends personal/professional lookup data to third parties and has weak safeguards around result integrity and API-key logging.

Install only if you are comfortable sending lookup targets and search snippets to SerpAPI or Brave and OpenAI. Treat returned emails as leads, not verified contacts; independently confirm addresses before use, avoid entering sensitive targets without a lawful basis, use a virtual environment with pinned dependencies, and remove API-key prefixes from logs before operational use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/find_contacts.py:130
Finding: Prompt Injection Through Untrusted Search Result Content
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:40
Finding: Unpinned Third-Party Dependencies in Installation Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/find_contacts.py:90
Finding: Partial Brave API Key Disclosure in Error Logs
Content: View full analysis
list[dict]: """Fallback: Search via Brave Search API.""" for key in BRAVE_API_KEYS: try: resp = requests.get( "https://api.search.brave.com/res/v1/web/search", params={"q": query, "count": 10}, headers={"Accept": "application/json", "X-Subscription-Token": key.strip()}, timeout=15 ) if resp.status_code == 200: results = resp.json().get("web", {}).get("results", []) # Normalize to SerpAPI format return [{"title": r.get("title", ""), "link": r.get("url", ""), "snippet": r.get("description", "")} for r in results] except Exception as e: print(f"[WARN] Brave search error ({key[:10]}...): {e}", file=sys.stderr) ``` ### Technical Analysis When a Brave request raises an exception, the application writes the first ten characters of the active API key to standard error. Although this is not the complete credential, secret prefixes should not be included in logs. Standard error may be captured by shell history tooling, CI systems, orchestration platforms, support bundles, or centralized logging infrastructure. Anyone with access to those logs can recover part of the credential and correlate it across systems or incidents. ### Attack Path 1. An attacker or operational failure causes the Brave API request to raise an exception, such as through a network or TLS failure. 2. The exception handler executes. 3. The first ten API-key characters are written to standard error. 4. Standard error is retained in a terminal transcript, CI artifact, service log, or monitoring platform. 5. A party with access to those logs obtains the credential prefix. ...[truncated 461 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/find_contacts.py:205
Finding: Unsafe Substring-Based Email Domain Validation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tainted flow: 'params' from os.environ.get (line 77, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/find_contacts.py (reported line 84)May include surrounding context.
python
"engine": "google" } try: resp = requests.get(url, params=params, timeout=15) resp.raise_for_status() data = resp.json() return data.get("organic_results", [])

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill declares no explicit tool scope even though its documented behavior requires network access and use of environment-provided API keys. Without clear permissions or allowed-tools constraints, an agent platform may grant broader capabilities than users expect, increasing the risk of unintended external requests or misuse of secrets during execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is designed to search for, infer, and transmit professional contact information to third-party services including SerpAPI and OpenAI, but it does not warn users that personal/professional data may be sent off-platform. This creates privacy, compliance, and user-consent risks, especially when searching named individuals or generating guessed email addresses that may constitute personal data processing.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/patterns.md (reported line 45)May include surrounding context.
md
## Notes - Always verify emails before sending (use SMTP check or verification API) - GDPR: Only use publicly available data; do not store without consent - Rate limit: SerpAPI free = 100 searches/month; paid plans available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script transmits search queries containing a person's name, company, and domain to external search providers, which can expose investigative intent and personal data to third parties. In this skill's context, the behavior is core to functionality, but it is still a genuine privacy issue because users are not clearly warned that this identifying information leaves the local environment.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/find_contacts.py (reported line 98)May include surrounding context.
python
for key in BRAVE_API_KEYS: try: resp = requests.get( "https://api.search.brave.com/res/v1/web/search", params={"q": query, "count": 10}, headers={"Accept": "application/json", "X-Subscription-Token": key.strip()}, timeout=15

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Search snippets may contain personal data, employer details, email addresses, and profile information, and the code forwards up to 15 snippets to OpenAI without consent gating, minimization, or a clear privacy notice. This creates a real data-sharing risk because third-party model providers receive potentially sensitive personal or company-related information during processing.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.