Security audit

converly

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for conversion tracking, but it should be reviewed because it can install live tracking, publish ad-platform flows, and default to broad form monitoring with hashed email sharing.

Install only if you intend to use Converly for ad conversion tracking. Before running it, pin or review the CLI package version, use staging where possible, confirm exactly which pages/forms should be monitored, and get explicit approval for Enhanced Conversions or any sharing of hashed customer identifiers with ad platforms.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: references/destinations.md:15
Finding: Site-Wide Form Monitoring and Default Disclosure of Hashed Email
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:57
Finding: Execution of Unpinned npm and npx Dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.
md
- [references/rest-api.md](references/rest-api.md) - curl equivalents for every step, for environments where the CLI cannot be installed. Full API docs: https:/

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README states that the agent can install tracking snippets, build flows, publish them, and send real test conversions, but it does not clearly warn users that these actions modify site code and can trigger live analytics/ad-platform events. In an agent context, this increases the chance of unreviewed production changes, accidental telemetry pollution, or unintended data transmission to third-party platforms.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says to use the skill whenever a user wants to track conversions, fix tracking, inspect which ads are converting, or connect common form tools, even if they never mention Converly by name. That broad trigger can cause the agent to invoke this powerful external-integration skill for ordinary analytics/help requests, increasing the chance of unnecessary third-party actions, environment probing, or workflow takeover beyond the user's actual intent.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
md
## Hard rules (read first) 1. **Never handle credentials in chat.** Do not ask the user to paste an API key, and never print `CONVERLY_API_KEY` or any token. Authentication is `converly login`, which happens in the user's browser. 2. **Connecting an ad platform requires a human.** `converly destinations connect` returns a URL the user must open in their browser. Never claim a destination is connected until `converly handoffs wait <id>` returns `"status": "completed"`. Never skip this step, and never work around it by asking for tokens. 3. **Be precise about what is verified.** `converly test-event` returning `"server_status": "success"` proves the DELIVERY half: Converly can reach the ad platform and the platform accepted the conversion. `install status` showing `"detection": "confirmed"` proves the loader is on the page and running (it phones home on page load). Neither proves the form itself gets detected. Full proof of capture is a real form submission appearing in `converly events list` with a successful action status. Report exactly which level you verified. Publishing a flow proves nothing by itself. 4. **Never pass `--allow-real` without the user's explicit agreement in this conversation.** It reports a real conversion to their ad platform. Ask, wait for yes, then run it.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: The skill instructs use of npx @converly/cli without pinning an exact version, which causes execution of whatever package version is current at runtime. That creates a supply-chain risk: a compromised latest release, dependency hijack, or unexpected breaking change could execute unreviewed code on the operator's machine during a security-sensitive workflow involving ad-platform connections and local credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation recommends leaving Enhanced Conversions enabled by default while transmitting hashed first-party data such as email, but it does not instruct the operator to obtain informed user consent or verify legal/privacy requirements first. Hashing does not remove the privacy sensitivity of the data, and this can lead to non-compliant ad attribution processing under privacy laws or platform policies.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/rest-api.md (reported line 11)May include surrounding context.
md
The rules from SKILL.md still apply, especially: a human completes the destination connect URL, and success is only reported after verification. Two curl rules for agents: - Always use `--fail-with-body`. Plain `curl -sS` exits 0 on HTTP 4xx/5xx, so a failed API call would look like success to your shell. - Generate ONE idempotency key per logical create (`IDEM=$(uuidgen)`) and reuse that exact value on any retry of the same operation. A fresh key on a retry can double-create.

Static analysis

No suspicious patterns detected.