Security audit

Pipedrive

Security checks for vulnerabilities and agentic risk

Overview

This Pipedrive skill is mostly coherent with CRM automation, but it grants broad CRM write, delete, file-transfer, and persistent webhook authority without enough local guardrails.

Review before installing. Use least-privilege Pipedrive scopes, require explicit confirmation for deletes, file transfers, lead conversion, and webhook creation, avoid wildcard webhooks, only send webhook events to verified destinations, and prefer pinned setup dependencies over the provided unpinned npx commands.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:232
Finding: Mutable Remote Instructions Can Override the Audited Skill Definition
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:138
Finding: Arbitrary Persistent Webhooks Can Exfiltrate CRM Event Data
Content: View full analysis
","event_action":"change","event_object":"deal","webhook_name":"deal-change-relay"} {"action":"create_webhook","subscription_url":"","event_action":"*","event_object":"lead"} {"action":"delete_webhook","webhook_id":123} ``` `create_webhook` requires `add` permission. `delete_webhook` requires `delete` permission. `list_webhooks` is read-only. ``` The corresponding schema accepts an arbitrary string: ```json "subscription_url": { "description": "Publicly reachable HTTPS URL Pipedrive will POST events to.", "required": true, "type": "string" } ``` ### Technical Analysis Webhook support is relevant to the declared CRM automation functionality. However, the documented interface permits an arbitrary publicly reachable HTTPS destination and broad wildcard subscriptions without requiring endpoint ownership verification, destination allowlisting, payload minimization, expiry, or explicit user confirmation. A webhook is a persistent outbound data flow that continues after the initiating agent interaction ends. T ...[truncated 1954 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:297
Finding: Installation Instructions Use Unpinned Remote Dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill prominently supports destructive and data-affecting actions including create, update, delete, convert_lead, file upload/download, and webhook subscription, but it lacks an explicit warning section requiring user confirmation for high-impact operations. In this CRM context, accidental execution can modify sales records, remove data, trigger downstream automations, or expose information via webhooks to third-party endpoints.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation keywords are broad phrases like creating, updating, moving deals, and scheduling follow-ups, which can cause the skill to be selected in loosely related contexts. In an agentic environment with write-capable CRM actions, over-broad invocation scope increases the chance of unintended record modification, lead conversion, webhook creation, or data disclosure to the external service.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 365)May include surrounding context.
md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`) - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/pipedrive - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 366)May include surrounding context.
md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`) - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`) - Marketplace product: https://www.agentpmt.com/marketplace/pipedrive - AgentPMT main MCP server: https://api.agentpmt.com/mcp/ - AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema exposes webhook creation, listing, and deletion capabilities that are not disclosed in the manifest description. Hidden event-subscription functionality expands the skill's authority beyond expected CRM CRUD operations and can be abused to exfiltrate CRM changes to attacker-controlled HTTPS endpoints or establish persistent monitoring.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Webhook subscription creation is not necessary for the manifest's described use of managing sales workflows, creating records, and moving deals through stages. Because webhooks can send ongoing CRM event data to external endpoints, this capability materially increases the danger of covert monitoring and exfiltration in a way that the stated skill context does not justify.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The schema includes file download, upload, update, and deletion operations that go beyond the manifest's stated sales-workflow purpose. This undisclosed file-management surface can be used to extract attachments into AgentPMT File Manager, alter evidence, or remove files, increasing data-loss and data-exfiltration risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The schema permits linking external Google Drive files into Pipedrive, but this cross-system integration is not mentioned in the manifest. Undisclosed remote-file linkage can introduce unauthorized data sharing paths, confuse trust boundaries, and help an attacker associate external content with sensitive CRM records.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.