Cold Email Campaigns with SalesBlink

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:17 AM UTC
• Version: 1.0.9

Overview

This SalesBlink skill is purpose-aligned but needs review because it asks for sensitive API/signup credentials in chat while enabling high-impact account, email, billing, and API-key actions.

Install only if you intend to let an agent operate a SalesBlink account. Configure SALESBLINK_API_KEY through the platform secret/environment mechanism, do not paste API keys or passwords into chat, and require explicit review before sending emails, importing leads or sender CSVs, changing billing/API keys, placing DFY orders, or archiving/deleting resources.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:102

Finding

API Key Requested Through Conversation Despite Environment-Based Secret Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:102-110
Vulnerability Type: Sensitive credential exposure through conversational context
Risk Level: Medium

Vulnerable Code

markdown

## Base URL

`https://run.salesblink.io/api/public/v1.0.0`

## Authentication

Ask the user for their SALESBLINK_API_KEY: `https://run.salesblink.io/account/integration/api`

Pass it in every request as the `Authorization` header (no "Bearer" prefix):

**Header:** `Authorization: key-****`

Technical Analysis

The Skill instructs the agent to ask the user for a complete SalesBlink API key. This conflicts with the safer environment-based secret mechanism already declared in SKILL.md:18-21, where SALESBLINK_API_KEY is configured as the primary environment variable.

A credential pasted into a conversation can enter model context, transcripts, application logs, observability systems, support exports, or retained chat history. The masked example does not prevent exposure when the user supplies the real key. Because the same credential authorizes every documented authenticated API operation, its disclosure violates least-exposure principles and creates a high-value credential-handling weakness.

Sending the key as an authorization header over HTTPS to the declared SalesBlink API is necessary for the Skill's functionality. The vulnerability is specifically the instruction to acquire the key through chat rather than exclusively through protected runtime secret injection.

Attack Path

1. The Skill follows SKILL.md:106 and asks the user to provide SALESBLINK_API_KEY.
2. The user pastes the complete key into the conversation.
3. The secret becomes part of conversational context or associated logging and retention systems.
4. An unauthorized person or compromised component with access to those records retrieves the key.
5. The attacker submits the key in the Authorization header to the SalesBlink API.

...[truncated 1122 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to ask users to paste SALESBLINK_API_KEY into chat.
2. Retrieve the key exclusively from the protected SALESBLINK_API_KEY runtime environment variable already declared in the Skill metadata.
3. If the variable is unavailable, instruct the user to configure it through the host platform's secret-management interface outside the conversation.
4. Never print, echo, summarize, log, or include the key in agent reasoning, tool output, error messages, or generated command examples.
5. Redact Authorization headers from HTTP diagnostics and observability data.
6. Avoid command constructions that could expose the key through shell history or process arguments; use an HTTP client's protected header configuration.
7. Document key rotation and revocation procedures for suspected disclosure.
8. Prefer a narrowly scoped API credential if SalesBlink supports scopes, and separate campaign-operation credentials from billing or credential-administration access.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (21)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md

- **Billing & payment methods** → [references/billing.md](references/billing.md)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly tells the agent to ask the user for their SalesBlink API key in chat. Collecting long-lived credentials through conversational history increases the risk of accidental retention, logging, prompt leakage, or reuse beyond the user's intent, especially since the skill already has an environment-variable mechanism (SALESBLINK_API_KEY) defined in metadata. In this context, the capability is operationally related to the skill, but the collection method is unnecessarily risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The signup flow instructs the agent to handle a user's email, password, and a returned API key, but provides no warning against collecting or echoing those secrets in chat. This creates unnecessary exposure of account credentials and newly issued API tokens in logs or transcripts, and the risk is amplified because successful signup immediately yields an API key that can be used for account access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file documents endpoints that return behavioral and communication data, including sent-email logs, open events, click events, and reply events. Under SQP-2 for markdown files, the description should warn users about privacy-sensitive behavior or data exposure, but no such warning is present anywhere in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented response contains an email field and associated activity metadata, which is personally identifiable information tied to user interactions. The markdown does not include any warning about handling, storing, or displaying this data safely, despite its privacy impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file describes a removal endpoint that deletes a lead from a list, but unlike the bulk import section it provides no warning about confirming the target contact or the impact of removal. Because this operation can affect user data, the skill description should explicitly disclose the destructive behavior.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/dfy.md (reported line 131)May include surrounding context.

md

### Fields

| Field              | Type   | Req | Description                                                                                                                            |
| ------------------ | ------ | --- | -------------------------------------------------------------------------------------------------------------------------------------- |
| `domains`          | array  | ✅  | Array of domain objects (see below). Buy and Connect domains cannot be mixed.                                                          |
| `type`             | string | ✅  | Mailbox provider: `google`, `outlook`, or `azure`                                                                                      |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/dfy.md (reported line 134)May include surrounding context.

md

| Field              | Type   | Req | Description                                                                                                                            |
| ------------------ | ------ | --- | -------------------------------------------------------------------------------------------------------------------------------------- |
| `domains`          | array  | ✅  | Array of domain objects (see below). Buy and Connect domains cannot be mixed.                                                          |
| `type`             | string | ✅  | Mailbox provider: `google`, `outlook`, or `azure`                                                                                      |
| `password`         | string |     | **Required for Google.** Common password for ALL mailboxes. Auto-generated if omitted for google buy domains with no custom mailboxes. |
| `redirectionUrl`   | string |     | Redirect URL for the domain                                                                                                            |
| `masterInboxEmail` | string |     | Master inbox email for admin access                                                                                                    |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/dfy.md (reported line 136)May include surrounding context.

md

| `domains`          | array  | ✅  | Array of domain objects (see below). Buy and Connect domains cannot be mixed.                                                          |
| `type`             | string | ✅  | Mailbox provider: `google`, `outlook`, or `azure`                                                                                      |
| `password`         | string |     | **Required for Google.** Common password for ALL mailboxes. Auto-generated if omitted for google buy domains with no custom mailboxes. |
| `redirectionUrl`   | string |     | Redirect URL for the domain                                                                                                            |
| `masterInboxEmail` | string |     | Master inbox email for admin access                                                                                                    |
| `couponCode`       | string |     | Optional Stripe coupon code                                                                                                            |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/dfy.md (reported line 138)May include surrounding context.

md

| `domains`          | array  | ✅  | Array of domain objects (see below). Buy and Connect domains cannot be mixed.                                                          |
| `type`             | string | ✅  | Mailbox provider: `google`, `outlook`, or `azure`                                                                                      |
| `password`         | string |     | **Required for Google.** Common password for ALL mailboxes. Auto-generated if omitted for google buy domains with no custom mailboxes. |
| `redirectionUrl`   | string |     | Redirect URL for the domain                                                                                                            |
| `masterInboxEmail` | string |     | Master inbox email for admin access                                                                                                    |
| `couponCode`       | string |     | Optional Stripe coupon code                                                                                                            |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/dfy.md (reported line 137)May include surrounding context.

md

| `type`             | string | ✅  | Mailbox provider: `google`, `outlook`, or `azure`                                                                                      |
| `password`         | string |     | **Required for Google.** Common password for ALL mailboxes. Auto-generated if omitted for google buy domains with no custom mailboxes. |
| `redirectionUrl`   | string |     | Redirect URL for the domain                                                                                                            |
| `masterInboxEmail` | string |     | Master inbox email for admin access                                                                                                    |
| `couponCode`       | string |     | Optional Stripe coupon code                                                                                                            |

### Domain object

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/dfy.md (reported line 142)May include surrounding context.

md

### Domain object

| Field       | Type    | Req | Description                                                                                                |
| ----------- | ------- | --- | ---------------------------------------------------------------------------------------------------------- |
| `domain`    | string  | ✅  | Domain name to purchase or connect                                                                         |
| `isConnect` | boolean |     | `false` = buy new domain (default), `true` = connect your own existing domain                              |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file describes a DELETE endpoint that removes a test and all associated tracking tasks, but it does not include any cautionary warning about data loss or irreversibility. For markdown files, destructive behavior that can affect user data or system integrity should be accompanied by an explicit warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reply endpoint performs real outbound email actions and can also upload attachments or embedded base64 images to S3, but the documentation does not prominently warn that invoking it will send messages to external recipients and transfer content off-platform. In an agent skill designed for automated cold outreach, this omission materially increases the risk of unintended email transmission, privacy leakage, and unauthorized external sharing if an agent uses the endpoint without explicit user confirmation.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/inbox.md (reported line 100)May include surrounding context.

}

text

| Field     | Type    | Description                                                                                                                                                              |
| --------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `unread`  | boolean | Mark as read (`false`) or unread (`true`)                                                                                                                                |
| `outcome` | string  | Classify the reply: `"interested"`, `"not-interested"`, `"automatic-response"`, `"meeting-request"`, `"out-of-office"`, `"do-not-contact"`, `"wrong-person"`, `"closed"` |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/inbox.md (reported line 102)May include surrounding context.

md

| Field     | Type    | Description                                                                                                                                                              |
| --------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `unread`  | boolean | Mark as read (`false`) or unread (`true`)                                                                                                                                |
| `outcome` | string  | Classify the reply: `"interested"`, `"not-interested"`, `"automatic-response"`, `"meeting-request"`, `"out-of-office"`, `"do-not-contact"`, `"wrong-person"`, `"closed"` |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The bulk sender import endpoint is documented as a simple CSV upload flow without any adjacent warning that the CSV may contain highly sensitive mailbox credentials or that the operation can create many live sender accounts at once. In the context of a sales outreach automation skill that manages SMTP/IMAP senders, this omission increases the chance a user uploads credential-filled spreadsheets insecurely, shares them in chat, or performs unintended large-scale account changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The archive endpoint documentation notes that archiving automatically pauses the sequence and removes pending email tasks, but it does not require or strongly warn about explicit user confirmation before performing this destructive action. In a sales automation skill, accidental or prompt-injected archiving could silently cancel scheduled outreach and cause operational disruption or campaign data/task loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file documents authenticated API requests and explicitly shows Authorization: SALESBLINK_API_KEY, but it does not include any user warning about handling API credentials securely. For documentation that references sensitive credentials, a brief warning helps prevent accidental exposure or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The Move Lead section documents an operation that changes where a lead resides, which can affect workflows and downstream automation, but it does not include any user-facing caution. For markdown files, behavior that can materially change user data organization should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The Archive Contact section exposes an operation that changes contact status and could hide or restore records in user workflows, yet no warning is provided beyond the ID format note. The documentation should alert users that this mutates contact state.

Content

No source excerpt is available for this finding.