ClawHub
Back to skill

Security audit

Zoho Books

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Zoho Books connector, but it can change or delete accounting data, email invoices, and includes unpinned setup commands that deserve review before installation.

Review this skill before installing if the connected Zoho Books account has edit or delete permissions. Prefer read-only access unless writes are needed, require human approval before deleting records, changing invoice status, emailing invoices, or matching bank transactions, and avoid the unpinned npx setup path unless you trust the current upstream package source.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:314
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 314, 318, 323–324, and 375–376
Vulnerability Type: Supply-chain risk from unpinned executable dependencies
Risk Level: Medium

Vulnerable Code

bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup

The same unpinned installation commands are also referenced individually in the setup and reference sections.

Technical Analysis

The Skill instructs users to invoke a third-party package through npx without pinning the package runner, package version, repository commit, or integrity hash. Depending on the local environment and package-resolution behavior, npx can download and execute code that is not part of the audited project.

Consequently, the effective installation payload can change after this Skill has been reviewed. The downloaded setup components are absent from the audited artifact, so their behavior—including lifecycle scripts, transitive dependencies, and credential-handling logic—cannot be verified by this audit.

Although installing the related AgentPMT setup Skills supports the declared integration workflow, executing mutable external dependencies is not the minimum-risk installation method.

Attack Path

  1. An attacker compromises the resolved package, upstream repository, maintainer account, release process, registry entry, or a transitive dependency.
  2. The attacker publishes or substitutes malicious content under the dependency reference used by the documented command.
  3. A user follows the Skill’s setup instructions and runs the unpinned npx command.
  4. npx resolves and retrieves the currently available external package and dependencies.
  5. Malicious package code or an installation lifecycle script executes locally with the privileges of the invoking user.

Impact Assessment

Successful exploitation could provide ...[truncated 581 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every executable package to a reviewed, exact version rather than resolving the latest available release.
  2. If installation resolves content from a source repository, pin it to an immutable commit hash.
  3. Publish and verify cryptographic integrity hashes or signed provenance for downloaded artifacts.
  4. Pin and audit transitive dependencies and disable installation lifecycle scripts where they are unnecessary.
  5. Prefer vendoring the required setup Skills into a reviewable distribution rather than downloading executable content at setup time.
  6. Document the exact expected source, version, publisher, and integrity value so users can verify the artifact before execution.
  7. Recommend installation in a restricted environment using a non-privileged account, minimal filesystem access, and constrained network permissions.
  8. Avoid requesting administrative privileges for installation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

md
Complete generated action schema: `./schema.md`.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documents destructive and externally visible actions such as deleting records, voiding invoices, emailing invoices, and matching bank transactions, but it does not explicitly require confirmation or warn about business impact before use. In an agent setting, that omission can enable accidental high-consequence actions against real accounting data or customer communications.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 378)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/zoho-books
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 379)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/zoho-books
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description highlights managing accounts, journal entries, contacts, invoices, bills, expenses, payments, projects, and time entries, with discovery terms emphasizing listing organizations, listing chart of accounts, creating journal entries, importing bank statements, and bank matching. This schema additionally exposes broad generic CRUD over many resources, including delete_record, which materially expands the operational scope beyond the manifest's more targeted description and examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The schema includes destructive and state-changing operations such as delete, update, void, match/unmatch, and email-send with only terse permission notes and no explicit warning about business impact or confirmation requirements. In an accounting context, accidental or manipulated invocation could alter financial records, trigger customer communications, or remove data, creating integrity and auditability risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest describes Zoho Books management operations such as accounts, journal entries, invoices, bills, expenses, payments, projects, and time entries, but it does not mention customer communications or email sending. invoice_email adds an external messaging capability that is not clearly implied by the stated purpose or disclosed in the manifest text.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.