T09 · Insecure Skill Coding Practices
Warning
- Location
lead_generator.py:194- Finding
CSV Formula Injection Through Unescaped Lead Fields
- Content
View full analysis
- Remediation
View remediation
Security audit
LeadGenerator
Security checks for vulnerabilities and agentic risk
Overview
The skill has low system access, but it claims to find real business leads while the code fabricates plausible company contact records without clearly warning users.
Review this carefully before installing. It appears to be a local demo-style generator, not a real company-search integration, and its output should not be treated as verified business contact data. Do not import or use generated leads for outreach, compliance, or CRM workflows unless the publisher clearly labels synthetic data or connects the skill to lawful, authorized data sources with provenance and export safeguards.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
lead_generator.py:101- Finding
Synthetic Business Identities Are Presented as Retrieved Leads
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly describes collecting company contact data and exporting it to CSV/JSON, but it provides no warning about privacy, lawful basis, terms-of-service restrictions, or responsible handling of personal/business contact information. This increases the risk that users will use the skill for scraping, bulk outreach, or non-compliant data processing without understanding legal and ethical constraints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains user-facing natural-language instructions exclusively in Polish, including the module docstring and usage examples. That effectively imposes a specific language on users without documenting a locale limitation or offering an alternative, which matches the language/locale policy violation criteria.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The help text tells users to use '--format csv' or '--format json' to export results, suggesting those modes are supported. However, main() only parses '--limit' and always calls format_leads_text(..., 'simple'), so the documented behavior contradicts the actual implementation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill documentation and all example interactions are presented only in Polish and are scoped specifically to Poland, without offering any language or locale choice. This can violate language/locale policy when a skill implicitly requires a specific language or region without explicit user opt-in or justification.
- Content