Security audit
Security checks for vulnerabilities and agentic risk
This skill is purpose-built for Instantly.ai campaign automation, but it can import leads and activate outbound email campaigns without explicit confirmation or privacy safeguards.
Install only if you intend to let the agent manage Instantly.ai campaigns. Before use, require explicit confirmation before importing leads, changing campaigns, or activating sends; review the exact lead fields and message content that will be sent to Instantly.ai; and prefer the narrowest API key scopes available rather than broad all-access scopes.
The trigger text is very broad and matches generic phrases like 'email outreach' or 'campaign activation,' which can cause the skill to be invoked in situations the user did not specifically intend. Because this skill can create, modify, and activate outbound campaigns against an external service, unintended invocation could lead to accidental data transmission or unauthorized campaign actions.
The skill instructs the agent to send lead identities, campaign content, and sender account data to Instantly's external API but does not warn the user that this information will leave the local context. In a workflow involving contact lists and personalized variables, lack of disclosure increases the risk of privacy violations, accidental sharing of sensitive business data, and non-compliant processing of personal information.
The sequence examples are written entirely in French ('Bonjour', 'Cordialement', 'Dernière relance') without indicating that French is optional, user-selected, or required for a specific regional use case. This can violate language/locale policy by implicitly steering the skill toward a fixed language without opt-in.
No suspicious patterns detected.
