Security audit

GoHighLevel

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent GoHighLevel CRM integration, but it can modify live customer, billing, messaging, and account data using a bearer token without strong safeguards.

Review before installing. Use a least-privilege sub-account token, not an agency-wide token unless necessary. Treat all send, delete, invoice, payment, workflow, social posting, and account-management actions as live production changes and require your own confirmation workflow. Consider patching or wrapping the scripts to block cross-origin redirects before using sensitive tokens.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ghl-api.py:52
Finding: Bearer Token Exposure Through Unrestricted HTTP Redirects in the API Client
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup-wizard.py:46
Finding: Setup Wizard May Disclose a User-Supplied Bearer Token Through Unrestricted Redirects
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (39)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
| | | | `GET /locations/{id}/customFields` — List | | | | | | `POST /locations/{id}/customFields` — Create | | | | | | `PUT /locations/{id}/customFields/{fid}` — Update | | | | | | `DELETE /locations/{id}/customFields/{fid}` — Delete | | | | | | **Custom Values CRUD:** | | | | | | `GET /locations/{id}/customValues` — List | | | | | | `POST /locations/{id}/customValues` — Create | |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
| | | | `GET /locations/{id}/customValues` — List | | | | | | `POST /locations/{id}/customValues` — Create | | | | | | `PUT /locations/{id}/customValues/{vid}` — Update | | | | | | `DELETE /locations/{id}/customValues/{vid}` — Delete | | | | | | **Tags CRUD:** | | | | | | `GET /locations/{id}/tags` — List | | | | | | `POST /locations/{id}/tags` — Create | |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
| | | | `GET /locations/{id}/tags` — List | | | | | | `POST /locations/{id}/tags` — Create | | | | | | `PUT /locations/{id}/tags/{tid}` — Update | | | | | | `DELETE /locations/{id}/tags/{tid}` — Delete | | | 11 | **Users** | `/users/` | CRUD, filter by email/role | `users` | | 12 | **Forms** | `/forms/` | List forms, get submissions | `forms` | | 13 | **Surveys** | `/surveys/` | List surveys, get submissions | `surveys` |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.
md
- **"Rotate and expire later"** — new token generated, old token stays active for 7-day grace period - **"Rotate and expire now"** — old token invalidated immediately (use for compromised credentials) - You can edit scopes without regenerating the token - **OAuth tokens** (marketplace apps only): Access tokens expire in 24 hours (86,399s); refresh tokens last up to 1 year - Agency tokens can access sub-account data by passing `locationId` parameter - **Rate limits are per-resource** — each sub-account independently gets 100/10s burst + 200K/day. SaaS endpoints: 10 req/sec global - All list endpoints default to 20 records, max 100 per page via `limit` param

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
md
## Webhook Events 50+ webhook event types for real-time notifications. Key events: `ContactCreate`, `ContactDelete`, `ContactTagUpdate`, `InboundMessage`, `OutboundMessage`, `OpportunityCreate`, `OpportunityStageUpdate`, `OpportunityStatusUpdate`, appointment events, payment events, form submission events. Webhooks continue firing even if access token expires. Config is per marketplace app. Docs: https://marketplace.gohighlevel.com/docs/webhook/WebhookIntegrationGuide ## Official SDKs & Developer Resources

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · references/conversations.md (reported line 13)May include surrounding context.
md
| GET | `/conversations/{conversationId}` | Get conversation | | POST | `/conversations/` | Create conversation | | PUT | `/conversations/{conversationId}` | Update conversation | | DELETE | `/conversations/{conversationId}` | Delete conversation | | POST | `/conversations/messages` | Send message | | POST | `/conversations/messages/inbound` | Add inbound message | | POST | `/conversations/messages/upload` | Upload attachment |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/troubleshooting.md (reported line 38)May include surrounding context.
text
## OAuth Token Lifecycle (Marketplace Apps Only) - Access tokens expire in **24 hours** (86,399 seconds) - Refresh tokens last up to **1 year** - Private Integration tokens do NOT expire (but 90-day rotation recommended) - `/oauth/token` is the ONLY endpoint that does NOT require the `Version` header

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/setup-wizard.py (reported line 102)May include surrounding context.
python
header("Step 2: Setting Up Your Private Integration") # If token not set, show instructions then prompt if not token_ok: p(f""" {BOLD}How to get your Private Integration token:{RESET}

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/setup-wizard.py (reported line 125)May include surrounding context.
python
header("Step 2: Setting Up Your Private Integration") # If token not set, show instructions then prompt if not token_ok: p(f""" {BOLD}How to get your Private Integration token:{RESET}

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill requires environment variable access and outbound network access but does not declare explicit tool scope or permissions boundaries in the manifest. This weakens least-privilege enforcement and makes it harder for a host agent to safely sandbox execution, especially because the skill can interact with live CRM data and messaging endpoints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises high-impact actions like sending messages, booking appointments, modifying pipelines, and creating invoices without an upfront warning that these are real-world, externally visible operations. In an agent setting, lack of prominent side-effect disclosure increases the risk of users authorizing or triggering destructive or customer-facing actions unintentionally.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The setup trigger phrases are broad natural-language matches such as 'connect my GHL' and 'set up highlevel', which can cause unintended activation in normal conversation. Since the setup path runs a script and tests live credentials against an external service, accidental invocation can create unexpected side effects or prompt for sensitive configuration unnecessarily.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file documents update, create, and delete operations for schemas and records, including irreversible deletion, but provides no warning about potential impact to user data or system state. Under the markdown-specific SQP-2 criteria, descriptions that omit warnings for behaviors affecting data integrity should be flagged.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The Associations section includes create, update, delete, and relation-creation endpoints, all of which can alter production relationship data. The documentation does not warn users that these actions change live associations or may have downstream effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The proposals/documents section includes endpoints that send documents or templates, which can trigger outbound communications and potentially expose customer-facing content. The markdown does not disclose that these operations may contact recipients or affect external parties.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Creating a share link can expose snapshot data to anyone with access to the generated link, which has privacy and access-control implications. The section does not include any warning about link sharing, scope of access, or the sensitivity of shared data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: These endpoints can change subscription or enablement state for locations or companies, including bulk operations that may affect many tenants at once. The documentation omits warnings about operational impact, reversibility, or the need for extra caution before executing account-wide changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The Voice AI section exposes call logs and multiple CRUD surfaces for agents, actions, and goals, which may involve sensitive conversational data and configuration changes. The documentation does not warn users about privacy considerations for logs or the production impact of modifying AI behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The Businesses section includes full CRUD operations, including deletion, which can alter or remove business records. The description lacks any caution about data integrity, deletion impact, or the need to verify the target business before mutating data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Deleting app installations and performing billing charge CRUD can disrupt integrations or affect financial records. The markdown does not disclose the operational or billing consequences of these endpoints, leaving users without adequate warning.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This summary lists groups such as email, media delete, phone system, conversation AI, knowledge base, and custom AI agents, all of which can affect privacy, user data, communications, or system behavior. The section provides no warning despite explicitly noting limited documentation, increasing the risk of misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file documents DELETE operations for calendars and appointments, which can affect user data and system integrity. The reference provides no warning or cautionary note about destructive behavior, confirmation expectations, or irreversible consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This reference documents multiple destructive and state-changing contact operations such as delete, update, tag removal, campaign/workflow removal, and note/task deletion, but provides no safety guidance, confirmation requirements, or warnings about irreversible effects. In a natural-language agent skill that exposes CRM actions directly, this omission increases the chance of unintended destructive actions or operator misuse, especially when an LLM may translate ambiguous user requests into API calls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file documents delete, void, payment-recording, and invoice-sending endpoints, which can affect user data, billing state, or customer communications. The file does not include any warning about destructive effects, reversibility, or the need for care when invoking these operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The troubleshooting guide includes a live POST example that creates a real contact in the connected GoHighLevel account, but it does not warn users that this mutates production data. In an agent skill context, examples are often copied or executed as-is, so this can lead to unintended data creation, CRM pollution, and accidental actions against customer environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.