Prospect Analyzer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:41 AM UTC
• Version: 1.0.1

Overview

The skill matches its prospect-research purpose, but it needs review because it can write workspace tracking files and instructs an unsafe, under-scoped curl fallback for user-provided sites.

Install only if you are comfortable with the agent browsing third-party sites and creating or updating prospect files in your workspace. Before using it on untrusted input, require public HTTPS-only targets and tell the agent not to use curl unless the URL is validated and invoked safely without shell interpolation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:229

Finding

Unvalidated User-Controlled URL Passed to a Shell-Oriented curl Fallback

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 229
Vulnerability Type: Command injection and server-side request forgery risk through insufficient URL validation
Risk Level: Medium

Vulnerable Code Snippet

markdown

- If the browser can't load a page, try curl as a fallback.

Technical Analysis

The skill accepts a user-provided company domain and instructs the agent to use curl when browser access fails. The instruction does not require validation of the destination, restriction to public HTTP or HTTPS resources, shell-safe argument handling, or filtering of private and reserved network addresses.

If an implementation constructs a shell command by directly interpolating the supplied value, shell metacharacters in a malicious “domain” could alter the command and result in command injection. Even when curl is invoked without a shell, accepting arbitrary URLs can enable server-side request forgery against resources reachable from the agent environment, including loopback services, private network hosts, and cloud metadata endpoints.

The vulnerable behavior is conditional on how the agent or runtime translates this natural-language instruction into a tool invocation. The absence of mandatory validation and safe invocation requirements nevertheless creates an exploitable unsafe execution pattern.

Attack Path

1. An attacker asks the skill to analyze a crafted domain or URL.
2. The supplied target is inaccessible through the browser, intentionally causing the documented fallback to be used.
3. The agent follows the instruction to invoke curl with the attacker-controlled target.
4. If the target is interpolated into a shell command, shell metacharacters may inject additional commands.
5. Alternatively, the target may reference or redirect to a loopback, link-local, private, or cloud metadata address.
6. curl executes the injected command or retrieves an internal resource using the agent host's network access.
7. Ret ...[truncated 795 chars]

Remediation

View remediation

Remediation Suggestions

1. Accept only explicitly validated https:// URLs, or normalize bare domains into HTTPS URLs after strict hostname validation.
2. Reject credentials in URLs, non-HTTP schemes, malformed hostnames, control characters, whitespace, and shell metacharacters.
3. Resolve the hostname before making a request and block loopback, link-local, private, multicast, unspecified, and reserved IPv4 and IPv6 ranges.
4. Apply the same address validation after every redirect to prevent redirect-based SSRF and DNS rebinding bypasses.
5. Invoke curl through a structured process API using a fixed executable and argument array rather than constructing a shell command.
6. Use the -- option before the URL so attacker-controlled values cannot be interpreted as command-line options.
7. Disable unnecessary protocols and constrain request behavior, including redirect count, connection and total timeouts, response size, and downloadable content type.
8. Run network retrieval with minimal filesystem, process, credential, and network privileges.
9. Replace the current instruction with explicit safe behavior, for example:

markdown

- If the browser cannot load the page, use the HTTP retrieval tool or invoke
  curl through a structured argument array. Only fetch validated public HTTPS
  URLs. Never interpolate the target into a shell command, and reject redirects
  or resolved addresses that point to loopback, link-local, private, or reserved
  networks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README describes website visits, blog auditing, competitor checks, lead scoring, and outreach-angle generation without warning users that the skill will access third-party websites and synthesize sales content from collected information. In context, that omission increases the chance of uninformed use and unexpected external browsing or persuasive-content generation, especially if the skill is invoked automatically from a generic request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrases are broad enough to match ordinary requests such as analyzing a company or checking a website, which can cause the skill to activate when the user did not explicitly intend prospecting or outreach behavior. In this skill, unintended activation is more sensitive because it may browse third-party sites, perform competitor research, and generate sales-oriented outreach content from the gathered data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description contains many broad natural-language trigger phrases such as 'research a company for outreach' and 'score this lead', which can cause the skill to activate in situations beyond the user's precise intent. Unintended invocation is risky here because the skill performs external browsing and can create or modify workspace files, so a loose trigger surface increases the chance of surprise actions or data changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs saving reports, creating a prospects directory, and optionally modifying a queue file, but it does not require prior user confirmation or prominently warn that workspace state will be changed. This is dangerous because an agent may perform persistent file writes or alter tracking data as a side effect of what appears to be a read-only analysis request, leading to unintended data modification or workflow corruption.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.