fore-vip-find-customers

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:09 AM UTC
• Version: 1.0.0

Overview

The skill is a legitimate B2B lead-generation helper, but it can send marketing emails from the user's connected mailbox without a clear per-message approval step.

Review this skill before installing if you connect Agent Mail. Use it for lead research and draft creation unless you are comfortable with the agent sending one-to-one marketing emails from your mailbox; confirm every recipient, source, subject, body, attachment, and embedded contact detail before any message is sent.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:86

Finding

Outbound Marketing Email Can Be Sent Without Explicit Per-Send User Approval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 86–94; related execution flow at lines 117 and 122–130
Vulnerability Type: Missing confirmation boundary for an external side effect
Risk Level: Medium

Vulnerable Skill Instructions

The following is an English translation of the relevant instruction block at lines 86–94:

markdown

### 5. Direct Email Outreach (send whenever a customer has a public email)

For customers in the Step 4 list who have a public email address,
perform one-to-one outreach.

- Embed the user's contact information in the generated image.
- Send the message through Agent Mail.
- The recipient address must come from a public source, and unauthorized
  bulk email must not be sent.

The related execution flow at lines 122–130 directs the agent to proceed from connector and identity checks to transmission:

markdown

Direct email outreach depends on the Agent Mail connector.

Purpose:
- Confirm sender identity: GetMe
- Upload the generated image: upload_attachment
- Send to the customer: SendMessage

Execution flow:
Confirm that the connector is connected, call GetMe to confirm identity,
upload the composed image, and call SendMessage to send it to the
customer's public email address.

A related boundary statement at line 117 limits sending to the user's mailbox but does not require approval for each message:

markdown

Direct email outreach may occur only when Agent Mail is connected and
must be sent from the user's own mailbox. If the environment is
unavailable, produce an email draft instead.

Technical Analysis

The skill treats the existence of a publicly listed recipient address, an available Agent Mail connector, and confirmation of the sender identity as sufficient conditions for sending an email. These conditions establish technical capability, but they do not establish the user's informed authorization for a particular external action.

There is no mandatory confirmation step requiring ...[truncated 2165 chars]

Remediation

View remediation

Remediation Suggestions

1. Make draft generation the default behavior. Lead discovery must produce an email draft rather than immediately invoke SendMessage.

2. Add a mandatory confirmation boundary. Before each transmission, display:

   • The exact recipient address and organization.
   • The source URL and collection date for the address.
   • The subject and complete message body.
   • Every attachment.
   • Any contact information embedded in an image.
   • The sender identity returned by GetMe.

3. Require explicit, action-specific approval. Invoke SendMessage only after the user clearly confirms the displayed message and recipients. A general request such as “find customers” must not count as authorization to send email.

4. Reconfirm material changes. If the recipient, subject, body, attachment, or sender changes after approval, invalidate the previous approval and request confirmation again.

5. Validate recipients before sending. Confirm that the address belongs to the intended organization, is currently published, and is appropriate for business inquiries. Mark uncertain addresses as unverified and do not send to them automatically.

6. Implement outreach safeguards. Add recipient deduplication, suppression and opt-out checks, conservative rate limits, and a record of the user's approval for each transmission.

7. Separate research from outreach permissions. Define lead collection and email transmission as distinct operations. Connector availability and sender-identity verification must never be interpreted as consent to send.

8. Use a safe failure mode. If approval is missing, ambiguous, expired, or cannot be recorded, stop before upload_attachment and SendMessage and return only the draft.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Line L73 states that the current model should prioritize English prompts and that Chinese prompts should be translated and polished before submission. This imposes a language preference in the skill guidance without explicitly offering the user a choice or requiring opt-in, which can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.