T09 · Insecure Skill Coding Practices
Error
- Location
scripts/score_lead.py:202- Finding
Unrestricted Outbound Requests Enable Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Lead Scorer
Security checks for vulnerabilities and agentic risk
Overview
This lead-scoring skill is mostly coherent, but its scanner can make unsafe network requests and disables HTTPS verification, so it should be reviewed before installation.
Install only if you are comfortable with it fetching websites and DNS records, extracting public contact details, and writing those results where you specify. Run it in an isolated environment, avoid scanning internal or private-network hosts, use it only for domains you are authorized to assess, pin the dnspython dependency, and fix destination validation plus normal TLS verification before using it at scale.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/score_lead.py:82- Finding
TLS Certificate and Hostname Verification Are Disabled
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:24- Finding
Unpinned Third-Party Dependency Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
``` 2. Generate and enforce cryptographic hashes using a lock-file workflow such as `pip-tools`, Poetry, or another reviewed dependency manager. 3. Install with hash verification enabled, such as `pip install --require-hashes -r requirements.txt`. 4. Install dependencies in an isolated virtual environment rather than the system Python environment. 5. Review and update the pinned version on a controlled schedule to receive security fixes. 6. Document the expected package index and avoid untrusted mirrors or extra indexes. 7. Add automated dependency vulnerability and integrity scanning to the release process. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises network access and the ability to write output files, but it does not declare any explicit tool scope or permissions boundaries. That makes its operational authority ambiguous and can lead to overbroad execution in agent environments, especially since it performs scraping, DNS queries, CSV ingestion, and optional file output.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill is designed to scrape websites, query DNS, and collect contact and social signals, but the user-facing description does not clearly warn about those data-collection behaviors or their privacy implications. In batch mode, this can cause users to process large sets of domains and associated contact information without informed consent or appropriate handling expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill performs live website scraping and extracts contact data without any explicit user-facing notice, consent boundary, or warning that contact information may be collected. In the context of a lead-scoring tool, that makes the behavior more dangerous because users may reasonably expect scoring signals, not silent harvesting of contact details from multiple pages.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script extracts email addresses from homepage, about, and contact pages and then includes them in its returned data. That goes beyond lead scoring into contact harvesting, which creates privacy, compliance, and misuse risk if the tool is used to build outreach lists or collect personal/business contact data without clear consent or disclosure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The output includes raw enrichment fields such as email addresses, social links, and detected tech stack in addition to the score. This materially broadens the skill from scoring to reconnaissance/enrichment, increasing the chance it will be used for profiling, unsolicited outreach, or downstream data aggregation beyond the stated purpose.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The top-level documentation frames the tool as a scorer producing a score and breakdown. However, the implementation returns raw_data containing extracted emails and social profile links, which is not just a scoring breakdown and materially broadens the apparent intent.
- Content
Static analysis
No suspicious patterns detected.