Security audit

Restaurant Lead Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is related to restaurant sales outreach, but it overstates its lead-finding capability and encourages automated contact/data storage without enough user control or disclosure.

Review before installing. Use this only as a draft or demo aid unless the publisher clearly separates synthetic sample data from real lead discovery, requires confirmation before any email or WhatsApp outreach, and documents data sources, storage location, retention, and compliance responsibilities.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description promises an operational restaurant lead generation and outreach skill with discovery, enrichment, multi-channel outreach, and pipeline management. The supplied code only creates fake/sample restaurant entries using random values and saves them to a CSV. While this loosely relates to 'lead generation' in theme, it does not actually find real businesses, enrich data, communicate with leads, or manage pipeline state. The primary behavior is synthetic data generation, which is materially different from the declared sales automation capability.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill describes capabilities that involve writing collected lead data to CSV and potentially using automation tooling, but it declares no explicit tool scope or permissions boundaries. In an agent environment, missing scope constraints can allow broader-than-expected file operations or related side effects, making accidental or unauthorized data writes more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill encourages automated outreach to external contacts and storage of collected lead data without warning the user that messages may be sent to third parties or that contact data will be persisted. In practice, this can lead to privacy issues, unsolicited messaging, compliance violations, and unintended data retention.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring states that the script 'Finds restaurants in target regions and outputs CSV,' but the implementation only generates random sample records. This mismatch is dangerous because operators may trust the output as real leads and feed it into enrichment, outreach, or pipeline automation, amplifying the impact of the fabricated data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code fabricates restaurant names, addresses, and phone numbers using random values while the skill metadata promises real lead discovery and enrichment. In a sales outreach context, this can cause downstream systems to treat fake businesses as genuine prospects, resulting in misdirected outreach, polluted CRM data, and unreliable business decisions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The skill targets specific regions such as the Dominican Republic, Puerto Rico, and Peru, and is oriented toward outreach in those markets, but it does not state whether outreach language should be selected based on user preference or recipient locale. This can create a locale-policy concern if the skill implicitly assumes a language for communications without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.