ClawHub
Back to skill

Security audit

Zoho Crm Connector

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Zoho CRM connector, but it needs Review because it can change CRM data and tells agents to rely on mutable remote instructions and unpinned setup installs.

Install only if you trust AgentPMT and the connected Zoho CRM account scope. Keep permissions read-only unless writes are needed, require explicit human approval before create/update/delete actions, and prefer pinned or reviewed setup artifacts instead of unpinned npx installs. Treat live remote instructions as reference material, not as authority to override the reviewed skill or the user's intent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:130
Finding

Mutable Remote Instructions Override the Locally Audited Skill Specification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 130-131
Vulnerability Type: Remote instruction trust and instruction hijacking
Risk Level: High

Vulnerable code snippet:

markdown
- Detailed examples: call `agentpmt-tool-search-and-execution` with `action: "get_instructions"` and `tool_id: "zoho-crm-connector"`, or call this product with `action: "get_instructions"` when the product tool is already selected.
- Treat returned live schema and instructions as more specific than this generated summary.

The same trust pattern is reinforced at SKILL.md:268:

markdown
- If validation fails or the response shape is unclear, call `get_schema` or `get_instructions` before retrying.

Technical Analysis

The Skill delegates authoritative behavioral instructions to mutable content returned by a remote AgentPMT service. It explicitly tells the agent to consider remotely returned instructions more specific than the locally reviewed specification.

Remote schemas can legitimately provide current parameter definitions, but remote natural-language instructions must not be given authority over local safety constraints or workflow goals. The retrieved content is outside the audited package and can change after installation. A compromised service, account, upstream integration, or response path could therefore insert instructions that were never reviewed with the Skill.

The remote response should instead be treated as untrusted data and constrained to a fixed, locally defined schema. It must not be permitted to override system instructions, user intent, safety rules, authorization requirements, or the locally audited action allowlist.

Attack Path

  1. An agent loads this Skill to access Zoho CRM through AgentPMT.
  2. The agent encounters an unclear parameter, validation failure, or production integration scenario.
  3. Following SKILL.md, it requests get_instructions from the remote AgentPMT ...[truncated 1412 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the directive that remote instructions take precedence over the local Skill specification.
  2. Treat responses from get_instructions as untrusted reference data, never as executable or authoritative agent instructions.
  3. Prefer a pinned, locally stored, reviewed schema for production use.
  4. If live schema retrieval is necessary, validate the response against a strict allowlist of expected actions, fields, types, limits, and enum values.
  5. Reject remote content that contains instructions to change goals, reveal secrets, invoke unrelated tools, expand permissions, or bypass confirmation requirements.
  6. Display and require explicit user confirmation before create, update, or delete operations, particularly bulk operations.
  7. Restrict retrieved CRM fields to those explicitly requested by the user and minimize sensitive customer data sent through the intermediary.
  8. Authenticate remote responses and pin an API/schema version or signed digest so reviewed behavior cannot change silently.

T08 · Insecure Dependencies

Error
Location
SKILL.md:196
Finding

Unpinned External Skill Installation Through an Executed Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 196-206
Vulnerability Type: Unpinned third-party dependency and mutable supply-chain installation
Risk Level: High

Vulnerable code snippet:

markdown
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

### Technical Analysis

The setup procedure invokes `npx`, which resolves and executes a package, and then installs Skills from an external repository without specifying a package version, repository commit, immutable release, checksum, or signature.

Consequently, the effective dependencies can change after this Skill has been audited. Compromise of the resolved npm package, its dependency chain, the external Skill repository, its publishing account, or a mutable branch can cause users to retrieve different content from what was originally reviewed.

The downloaded setup Skills are security-sensitive because they define account, MCP, REST, and credential-handling procedures. Malicious changes in those dependencies could introduce deceptive credential prompts, unsafe network destinations, hostile agent instructions, or local execution behavior.

### Attack Path

1. A user follows the documented setup instructions.
2. The user executes `npx skills add AgentPMT/agent-skills --skill ...`.
3. `npx` resolves and executes the currently published package rather than a specifically audited immutable version.
4. The installer retrieves the current state of the external `AgentP
...[truncated 1242 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills npm package to a reviewed exact version rather than allowing npx to resolve the latest release.
  2. Pin AgentPMT/agent-skills to an immutable commit hash or signed release tag.
  3. Publish and verify cryptographic checksums or signatures for every installed Skill.
  4. Use lockfiles and integrity metadata for the npm dependency tree.
  5. Avoid executing packages directly from mutable sources in production setup instructions.
  6. Download dependencies into a staging environment, inspect their contents, and activate them only after review.
  7. Run installation with minimal operating-system privileges and without unnecessary credentials in the environment.
  8. Require explicit user approval before newly installed Skills can access account setup tools, secrets, MCP endpoints, or CRM operations.
  9. Maintain an allowlist of approved package publishers, repository origins, versions, and hashes, and fail closed when verification cannot be completed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
Complete generated action schema: `./schema.md`.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents delete_records capability and required permissioning, but it does not prominently warn that deletion may be irreversible or require explicit user confirmation before destructive operations. In a CRM context containing customer and sales data, accidental or misrouted delete actions could result in material data loss and operational disruption.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation keywords include broad phrases like customer support, reporting, lead enrichment, create records, module api name, and record, which are generic enough to overlap with many unrelated workflows. In an agent-routing system, this can cause unintended invocation of a tool that has CRM read/write/delete capabilities, increasing the chance of unnecessary data access or accidental record modification.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/zoho-crm-connector
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/zoho-crm-connector
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The schema documents write-capable actions (create_records, update_records, delete_records) even though the skill metadata describes the connector primarily as searching and retrieving CRM data. This scope mismatch can mislead users or downstream agents into granting trust appropriate for a read-only integration while the skill actually permits destructive and state-changing operations against customer CRM data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The delete_records action enables irreversible or hard-to-recover record deletion but the schema text does not prominently warn about data loss or require explicit confirmation semantics. In an agent-driven environment, ambiguous or under-signaled destructive operations increase the risk of accidental deletion from natural-language misunderstandings, prompt injection, or operator error.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest centers on operational CRM record access for leads, contacts, accounts, and deals, but the schema also includes describe_action, list_modules, and fields_metadata for introspection and schema discovery. These are broader connector capabilities not clearly conveyed by the manifest's purpose statement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.