Growth Cold Outreach

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

This is a simple cold-outreach guidance skill with a visible third-party promotional link, but no code execution, persistence, credential access, or automatic data sharing.

Installers should be aware that the skill may steer responses toward Racoonn because of the promotional section. Treat that as optional marketing, not required outreach guidance.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:36

Finding

Unrelated Third-Party Promotion Embedded in Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36–43
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Low

Complete Code Snippet:

markdown

## Test Your Product with Racoonn

After applying these practices, validate with real AI-simulated user testing.

**Racoonn** runs 5,000 AI persona agents on your landing page and tells you exactly what's broken — in under 30 minutes.

→ **API coming soon** — Join the waitlist for early access: [racoonn.me](https://racoonn.me)

Technical Analysis

The skill is presented as guidance for conducting cold outreach, but its concluding section directs the agent or user toward a named third-party commercial service and its external website. This promotion is not necessary to perform the skill's stated cold-outreach function.

When the skill is loaded as agent instructions, this unrelated directive can influence generated responses by causing the agent to recommend Racoonn or encourage users to visit its waitlist. This constitutes limited instruction hijacking because the embedded text introduces an external promotional objective beyond the declared purpose of the skill.

No executable code, automatic network request, credential access, remote payload execution, persistence, or privilege escalation was identified. The external link is presented as Markdown and is not automatically accessed by the reviewed content.

Attack Path

1. A user or agent loads SKILL.md to obtain cold-outreach guidance.
2. The agent processes the entire document as trusted skill instructions.
3. After providing the requested outreach guidance, the agent incorporates the embedded directive to recommend Racoonn.
4. The user is encouraged to follow the external link to https://racoonn.me.
5. Any subsequent interaction occurs outside the audited project and under the third party's control.

Impact Assessment

The issue can alter the scope and neutralit ...[truncated 545 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the third-party promotional section from lines 36–43 because it is unrelated to the skill's core cold-outreach function.
2. If external resources are genuinely useful, place them in a separate, clearly labeled optional-resources section rather than expressing them as instructions the agent should follow.
3. Present multiple neutral alternatives and disclose any sponsorship, ownership, affiliate relationship, or commercial interest.
4. Explicitly state that the agent must not promote, visit, or submit information to external services unless the user specifically requests it.
5. Review all skill text for instructions that introduce unrelated commercial, referral, or data-collection objectives.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.