Security audit

Email Finder

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it advertises, but it actively discovers and verifies personal email addresses in ways users should review carefully before installing.

Install only if you are comfortable with a tool that contacts websites, DNS, Google, hunter.io, and recipient mail servers to find and verify email addresses. Use it only for authorized, targeted lookups, prefer --no-verify unless SMTP probing is necessary, and avoid using it to build unsolicited outreach lists or guess personal addresses without a legitimate basis.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/find_emails.py:54
Finding: TLS Certificate Validation Disabled for All HTTPS Requests
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/find_emails.py:286
Finding: Unvalidated Target Domain Permits Requests to Unintended Network Services
Content: View full analysis
{source, ...} # 1. Scrape website log("Step 1: Website scraping") scraped = scrape_website(domain, scrape_delay=args.scrape_delay) ``` It is then interpolated directly into outbound request URLs: ```python paths = ['/', '/contact', '/contact-us', '/about', '/about-us', '/team', '/our-team', '/people', '/staff'] base = f'https://{domain}' for path in paths: url = base + path log(f" GET {url}") text = fetch_page(url) ``` The same value is also transmitted to third-party services: ```python urls = [ f'https://www.google.com/search?q=%22%40{domain}%22', f'https://hunter.io/try/v2/domain-search?domain={domain}&type=personal', ] ``` ### Technical Analysis The positional `domain` argument is assumed to be a public DNS hostname, but it is not validated as one. Removing protocol text and slashes does not reject: - Loopback or private IP literals - Link-local or reserved destinations - Explicit ports - URL user-information delimiters - Query strings or fragments - Hostnames that resolve to private addresses - Public hosts that redirect to internal destinations The value controls website requests, DNS lookups, third-party query parameters, and potentially SMTP destinations derived from MX records. `urlopen()` can also follow redirects, but redirect destinations are not revalidated. The Skill legitimately requires outbound access to the selected public domain, public DNS infrastructure, s ...[truncated 1865 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:22
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
``` For stronger supply-chain protection: 1. Generate and verify package hashes. 2. Install with `pip install --require-hashes -r requirements.txt`. 3. Commit the dependency manifest or lock file to the project. 4. Review and deliberately update dependency versions. 5. Run automated vulnerability and license scanning against locked dependencies. 6. Use a trusted package index and avoid unreviewed alternate indexes. 7. Document the supported Python and dependency versions. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly performs network actions including web scraping, DNS lookups, search queries, and SMTP recipient verification, but it declares no explicit tool scope or permission boundary. That mismatch can let the skill be invoked with broader network capability than users or policy expect, reducing visibility and control over outbound interactions with third-party systems.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description is framed broadly around prospecting leads, outreach, and building contact lists, which can cause the skill to be selected for common business requests without sufficient scrutiny. Because the skill performs personal data discovery and active verification against mail servers, broad invocation language increases the chance of privacy-invasive or policy-violating use in routine workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly supports generating likely personal email addresses from a person's name and verifying them via SMTP, but the description lacks a clear privacy, consent, and anti-harassment warning. In context, this makes the capability more dangerous because it facilitates identifying and validating personal contact data for outreach or targeting, which can enable spam, stalking, or unauthorized profiling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The search and scraping logic sends requests containing the target domain to external sites, including Google and hunter.io, without clearly warning that target information will be disclosed to third parties. In a lead-generation/email-finding skill this is especially sensitive because the queried domains and patterns can reveal prospecting targets, investigations, or internal workflow, creating privacy and operational exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script performs active SMTP RCPT probing against third-party mail servers, which discloses the operator's interest in specific domains and guessed addresses and may trigger logging, blocking, or abuse responses. In this skill context, email enumeration and validation are core features, so the behavior is intentional, but the lack of explicit warning/consent and the default-on verification make the privacy and policy risk materially higher.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The docstring states that, because web_search is unavailable, the function will 'try common directories.' However, the implementation constructs outbound requests to a Google search URL and a hunter.io domain-search endpoint instead of directory pages. This is a direct contradiction between documentation and behavior, not merely omitted detail.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The CLI defines '--verify' as a store_true flag with default=True, so it does not meaningfully enable anything that was disabled; verification is actually governed by 'do_verify = not args.no_verify'. This makes the documented behavior of the '--verify' option misleading relative to the code's actual control flow.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.