Detect Revenue Leaks & Alert Teams via Slack Integration

• Outcome: Review
• Latest audit: Aug 29, 2026 · 2:11 AM UTC
• Version: 1.0.0

Overview

This skill is a marketing analytics workflow, but it asks for live payment and customer-data credentials while making inconsistent promises about PII handling and campaign activation.

Review before installing. Use read-only, least-privilege credentials where possible; avoid live production keys until scope is explicit; require masking of customer identifiers before Slack or Sheets output; and treat all generated campaigns, exports, webhooks, and CRM tags as draft-only until a human approves them.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The skill claims it will not analyze or export customer PII, but the documented example output includes a directly identifiable customer email address and the workflow explicitly discusses exports to Slack and Google Sheets. This mismatch creates a deceptive safety boundary: operators may trust the skill with sensitive data under false assumptions, increasing the risk of unauthorized disclosure of customer information.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The guardrail says emails will not be sent without explicit approval, yet the skill also describes immediate campaign actions, direct exports to email platforms, webhooks, and automation-triggered sequences. Even if not overtly malicious, this inconsistency can lead users or agents to initiate messaging workflows without meaningful human review, especially in integrated marketing systems.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The description uses broad business terms like LTV optimization, churn prevention, and strategic revenue growth, which can cause the skill to be invoked in situations beyond its intended safe scope. Overbroad triggering is risky here because the skill handles sensitive business and customer datasets, so accidental invocation could expose credentials, customer records, or prompt unnecessary integrations.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The quick-start phrase 'Run full revenue leak analysis on my Stripe + Mailchimp data' is broad and lacks scope limits, validation steps, or warnings about sensitive production data. In a skill that expects live API access, such generic invocation raises the chance of unintended full-account analysis and data movement without first confirming dataset boundaries, minimization, or approval requirements.

Credential Access

High

• Category: Privilege Escalation

Content

export MAILCHIMP_LIST_ID="your_list_id"

# Google Sheets (output reports)
export GOOGLE_SHEETS_API_KEY="your_google_credentials.json"
export GOOGLE_SHEET_ID="your_sheet_id"

# Optional: CRM/Analytics

• Confidence: 94% confidence
• Finding: The skill explicitly requires high-privilege secrets such as a live Stripe API key, Mailchimp API key, and Google credentials file, and even instructs users to verify connectivity with curl. This expands the attack surface substantially: any downstream prompt injection, logging mistake, misconfigured export, or overbroad agent behavior could expose or misuse financial and customer-data credentials.

Static analysis

No suspicious patterns detected.