Security audit

leadgenius cli AI lead management platform

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only skill is not malware, but it teaches an agent broad admin, database, identity, backup, and purchasing actions beyond routine lead management.

Install only if you intend to let an agent operate LeadGenius with privileged administrative scope. Use least-privilege API keys, keep LGP_ADMIN_KEY, Epsimo tokens, browser cookies, and real passwords out of routine agent sessions, require explicit human approval for deletes/transfers/purchases/backups, and test against non-production data first.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (45)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file for a LeadGenius automation skill also documents EpsimoAI activation, token handling, thread/credit inspection, and credit purchase flows. This materially expands the reachable capability surface beyond the declared skill purpose, increasing the chance that an agent or user invokes unrelated account and billing operations with sensitive tokens.

Description-Behavior Mismatch

Low

Confidence: 80% confidence
Finding: The skill description says the tool operates the LeadGenius automation API, but the reference also includes Cognito/browser-session-only job-triggering and Unipile notification features. Hidden authentication modes and omitted capabilities can mislead operators and agents about what identities are being used and what actions are possible.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The documented optional X-Admin-Key bypasses all rate limits, creating a privileged path that weakens abuse controls if exposed to an agent, logs, or prompt context. For an automation skill, this is especially dangerous because agents can rapidly amplify requests and data access once a bypass secret is available.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The generic cross-table CRUD API exposes broad access to many platform models, including users, companies, settings, integrations, and system tables, far beyond narrow lead-generation use cases. Giving an agent a generic database-like interface sharply increases the blast radius of prompt abuse, parameter mistakes, and privilege misuse.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The CLI reference exposes broad low-level admin, Cognito, and backup operations that materially exceed the stated business scope of lead generation and campaign automation. This increases the blast radius of the skill by enabling tenant administration, identity management, and infrastructure data operations through the same interface, creating opportunities for privilege misuse or accidental destructive actions.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Generic CRUD against any DynamoDB table is an over-broad primitive that can bypass intended business-level guardrails and expose or alter arbitrary application data. In an agent skill context, this is dangerous because it gives a single interface the ability to read, modify, or delete sensitive configuration and operational records far outside the advertised use case.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Direct backup, restore, and PITR management are infrastructure-admin capabilities, not normal leadgen operations, and they enable copying, restoring, or deleting large data stores. If misused, they can cause data exposure, unauthorized duplication of sensitive tenant data, unexpected recovery-state changes, or irreversible backup loss.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: EpsimoAI activation, token handling, and credit purchase operations introduce third-party account and spend-affecting actions unrelated to the stated leadgen scope. This broadens the trust boundary and allows an agent/operator to manipulate external accounts and paid resources through the same skill surface.

Missing User Warnings

High

Confidence: 66% confidence
Finding: The README exposes a generic CRUD interface capable of deleting records across many high-value tables, including multi-tenant, integration, webhook, and configuration data, without any warning about destructive scope. In this skill context, broad table-level delete guidance can materially increase operator error and unsafe agent behavior because it normalizes direct deletion of sensitive business and system records.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill documents use of sensitive API credentials, including an elevated admin key, without any guidance on secure handling, redaction, logging avoidance, or least-privilege usage. In an agent setting, that increases the chance the model will echo secrets in commands, store them in shell history, or use the admin key broadly, leading to credential exposure or excessive access.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The skill enables lead generation, enrichment, scoring, qualification, webhooks, and email delivery, all of which can process personal/business contact data and trigger external actions. Without an explicit warning about handling prospect/customer data and modifying external systems, an agent may perform privacy-sensitive or production-impacting operations without operator awareness or confirmation.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The webhook detail endpoint returns raw request bodies and normalized payloads, which may contain personal data, message content, and third-party integration metadata. Exposing raw payloads through an agent-friendly API raises privacy and data-minimization concerns because sensitive inbound webhook contents can be surfaced unnecessarily to prompts, logs, or downstream tools.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Examples for Cognito creation and provisioning include plaintext passwords and one-time plaintext API keys, which can normalize insecure handling and increase the chance secrets are pasted into prompts, terminals, chat logs, or transcripts. In an agent context, plaintext-secret examples are especially dangerous because models may echo, store, or transform them.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: Destructive commands are documented without warnings or confirmation guidance, making accidental data loss more likely during normal use. In an agent-operated CLI, omission of safety prompts materially raises the chance of unintended deletion or mutation at speed.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The user removal operation lacks an explicit warning about access loss and downstream operational impact. Without clear guidance, an agent or operator may remove users without understanding that login, ownership, workflow access, and audit continuity may be affected.

Missing User Warnings

High

Confidence: 94% confidence
Finding: Company deletion is a highly destructive action, yet the reference omits an explicit warning about irreversibility and broad tenant impact. In this skill context, deleting an organization could remove access to users, clients, and associated operational data, making mistakes severe.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Passing passwords on the command line exposes secrets through shell history, process listings, logs, and telemetry. Because this skill provisions real user accounts, the leaked credential could be reused to gain unauthorized access to the platform or linked services.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The direct Cognito creation examples also place passwords on the command line, creating the same credential exposure path via shell history and process inspection. Since these accounts are identity-provider level accounts, compromise can have broader authentication impact than ordinary app-only credentials.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: Company member removal changes authorization state and can disrupt access to data, clients, or workflows, but the reference does not warn about that impact. In a multi-tenant admin context, such omissions increase the risk of accidental lockout or unauthorized business disruption.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Supplying Epsimo tokens on the command line risks exposure through shell history, process arguments, debugging output, and logs. Because the token authorizes profile access and purchases, leakage could enable unauthorized third-party account use and spend.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: Deleting backups is potentially irreversible and weakens recovery posture, but the documentation does not provide a prominent warning. In an admin backup interface, lack of friction around deletion can directly increase the impact of mistakes or malicious misuse.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation instructs users to create accounts, passwords, and API keys and explicitly notes that a plaintext API key is returned once, but it does not include clear guidance on secure secret handling, storage, rotation, or avoiding shell/history leakage. In a lead-generation automation product with admin provisioning powers, this omission increases the likelihood of credential exposure through terminals, screenshots, logs, or copied examples.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The guide instructs users to transmit lead records and webhook-derived engagement data to external email platforms and review webhook payloads without any privacy, consent, or data-sharing warning. Because this data can include personal information and behavioral tracking, the omission can lead to unlawful or inappropriate disclosure to third parties.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow documents merge and transfer operations that change record state and can effectively overwrite, reclassify, or move data, but it does not place a prominent warning immediately before the irreversible steps. In an agent skill context, users may execute commands verbatim, so the absence of explicit confirmation and rollback guidance increases the risk of accidental destructive actions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The workflow offers deletion of unmatched webhook events as an optional cleanup step but does not clearly warn that the deletion is permanent and may remove audit/history data needed for troubleshooting or reprocessing later. Because webhook logs can contain evidence of delivery, matching, and engagement behavior, silent loss can impact integrity and incident response.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.secret_argv_exposure

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: README.md:95

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:26

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: references/api_endpoints.md:2188