T08 · Insecure Dependencies
Error
- Location
SKILL.md:29- Finding
Automatic Installation of an Unpinned External Skill
- Content
View full analysis
- Remediation
View remediation
Security audit
Overseas Engineering Bd
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent business-development workflow, but it asks agents to auto-install another skill and operationalizes contact scraping, enrichment, syncing, and outreach without enough user approval or privacy controls.
Review this skill before installing. Use it only with explicit approval for any dependency install, vetted and pinned external tools, lawful contact sources, approved business accounts, opt-out handling, and human review before enriching contacts, syncing them to Google/WhatsApp, or sending outreach.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Error
- Location
references/oe-requirements.md:130- Finding
Unspecified Open-Source WhatsApp Detection Script
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/oe-requirements.md:87- Finding
Personal Contact Data Replication Without Enforceable Privacy Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs users to export names and phone numbers from Feishu into Google Contacts so they appear in WhatsApp for outreach, without any warning about contact-list exposure, account syncing, over-collection, or consent for messaging. This is more dangerous in context because it directly converts scraped or enriched personal data into actionable messaging targets on consumer/mobile platforms, increasing the risk of privacy violations, unauthorized processing, and spam or harassment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill advertises outreach execution over email and WhatsApp, plus contact enrichment and background investigation, but does not present clear warnings about external communications, personal data handling, or consent/compliance obligations. This increases the risk of privacy violations, spam/abuse, and inadvertent transmission of sensitive or inaccurate data to third parties.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill claims it is only a passive reference repository, but elsewhere defines activation-time behavior that installs and loads another skill and delegates operational execution. This mismatch can mislead reviewers and users about the skill's actual capabilities, weakening trust boundaries and enabling unexpected dependency-mediated actions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation says the skill cannot execute without UTOS, yet instructs activation-time auto-installation of UTOS, effectively turning a nominally non-executing reference skill into a bootstrapper. Auto-installing a dependency expands the trust boundary to external code and can introduce unreviewed functionality at activation time.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Automatic dependency installation without clear warning or confirmation is risky because it can cause users to import additional code and privileges they did not intend to trust. In a skill ecosystem, this creates a supply-chain and consent problem: the referenced dependency may change behavior, access data, or perform actions beyond the user's expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill file is written as Chinese-only operational guidance and does not provide any indication that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without opt-in is in scope even when it appears in documentation rather than executable code.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The catalog explicitly includes collecting contact details, enriching them, and importing them into CRM/Feishu systems, but it provides no guardrails around lawful basis, consent, retention, minimization, or handling of personal data. In this skill context, the data pipeline is operationalized across collection, enrichment, and outreach, which increases the likelihood of privacy violations, unauthorized profiling, and misuse of personal/business contact information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill defines WhatsApp number checking, persona-backed personalized messaging, and timed outreach SOP execution without any warnings about anti-spam rules, platform terms, consent, or account enforcement risk. In context, this is not merely drafting content; it describes a workflow for validating targets and automating contact at scale, which can facilitate unsolicited messaging, evasion of recipient expectations, and account or legal compliance issues.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly directs enrichment of personal contact data via third-party data brokers (e.g., Hunter.io/Apollo.io) and merges those results into a master dataset, but provides no consent, lawful-basis, minimization, retention, or disclosure controls. In the context of cross-border lead generation and outreach, this creates a real privacy and compliance risk because it operationalizes collection and use of personal data for unsolicited contact at scale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
All natural-language instructions and task descriptions in the file are presented only in Chinese, with no indication that users can opt into another language. Under SQP-3, forcing a single language without user choice can constitute a language-policy issue when no justification or opt-in is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The schema explicitly requires 'project_name' to be translated into Chinese, which imposes a language choice in natural-language instructions. The document does not offer user opt-in or explain that the skill is restricted to a Chinese-language workflow.
- Content
Static analysis
No suspicious patterns detected.