Security audit

Salesmartly Api

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent SaleSmartly automation tool, but it bundles sensitive credentials and gives agents broad customer-data, mutation, webhook, and local code-generation capabilities with uneven disclosure and weak safeguards.

Install only after removing the bundled api-key.json, reviewing or deleting .claude/settings.local.json, and confirming that your agent will require explicit approval for destructive operations, bulk changes, chat-history access, and any DingTalk or other webhook export. Treat generated scripts as developer-only artifacts that should be reviewed before execution.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (43)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no permissions while its documented capabilities clearly include shell execution, network access, environment-variable use, and file read/write via local scripts and config handling. This creates a transparency and policy-enforcement gap: an agent or reviewer may approve or invoke the skill without understanding that it can access secrets, modify local files, and send data externally.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose frames the skill as a SaleSmartly API operations tool, but the analysis indicates additional behaviors including external DingTalk exfiltration paths, remote documentation fetching, script generation, update checks, external model API calls, and subprocess-based test harnesses. This mismatch materially increases risk because operators may invoke or trust the skill for routine CRM actions while hidden or under-disclosed behaviors can transmit data externally or execute broader local workflows.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The guide documents capabilities such as DingTalk push notifications, cron-like scheduled tasks, and GitHub issue automation that appear broader than the declared SaleSmartly API skill scope. This can mislead users and the orchestrating agent into enabling unexpected outbound integrations and automation paths, increasing the chance of unauthorized data egress or execution through undeclared components.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The document claims that no data is uploaded to external servers except the SaleSmartly API, yet elsewhere it describes sending reports and customer-related alerts to DingTalk and recording feedback to GitHub. This contradiction creates a serious transparency failure: users may disclose customer data under false assumptions about where it will be transmitted, leading to privacy, compliance, and trust violations.

Intent-Code Divergence

Medium

Confidence: 85% confidence
Finding: The README claims there is 'no dynamic code generation or download', yet it documents tools like generate-query-script.py and batch-generate-scripts.py. This contradiction can mislead users and security reviewers into underestimating the risk of generated code paths, especially in an agent skill context where generated scripts may later be executed with API credentials.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The documentation explicitly states that Python requests may need to skip SSL certificate verification, which normalizes an unsafe practice without warning about man-in-the-middle risk. In an API skill that handles authentication material and customer/sales data, disabling certificate validation could expose API keys, session data, and responses to interception or tampering.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: This code retrieves remote documentation and uses it as input to generate local Python scripts. Even with TLS enabled, the design creates a supply-chain/code-generation pathway where compromised or malformed remote content can influence new executable files, which exceeds the stated end-user CRM operation purpose of the skill.

Description-Behavior Mismatch

Medium

Confidence: 80% confidence
Finding: The generator creates arbitrary additional API scripts from remote docs, which materially expands the skill's capabilities beyond the declared set of 29 core scripts. That mismatch reduces auditability and can introduce unreviewed functionality that users and reviewers would not expect from the manifest.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: This section writes newly generated Python files directly into the skill's scripts directory, giving the skill self-expansion capability. In the context of an agent skill, writing executable code locally is dangerous because later execution paths may pick up these files, enabling persistence and unreviewed behavior changes from remotely derived input.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The module header labels the script as a safe, query-only analytics operation, but the implementation retrieves and displays raw customer message excerpts together with user and session identifiers. That mismatch can mislead operators and downstream agents into treating the script as low-risk, increasing the chance that sensitive customer data is exposed without appropriate review or consent.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The module docstring marks the script as a safe query operation, but the code also performs an outbound action by posting report content to a DingTalk webhook. This mismatch can mislead operators, policy engines, or approval workflows into treating the skill as read-only when it actually exfiltrates customer-derived data to an external destination.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: This script retrieves remote API documentation and uses it to generate Python code locally. Even though it does not execute the generated code immediately, introducing code-generation and external content ingestion into a CRM/API skill materially expands the trust boundary and creates a supply-chain style risk if the remote documentation is tampered with or unexpectedly malformed.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The file writes a newly generated Python script to disk and marks it executable, which creates a durable artifact that can later be run with the user's privileges. In the context of a business assistant skill, this is a higher-risk capability than ordinary API interaction because it enables local file creation and staged code deployment from externally sourced content.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The client exposes a generic `post_webhook(url, payload)` primitive that can send JSON to any caller-supplied URL, which expands the skill from a SaleSmartly API wrapper into an unrestricted outbound HTTP sender. In an agent environment, this can enable data exfiltration, SSRF to internal services, or unauthorized callbacks if upstream inputs can influence the webhook URL or payload.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The method accepts an arbitrary external URL and performs outbound POST requests without destination restrictions, which is a classic SSRF and exfiltration sink. Because this skill is described as handling sales/customer/session APIs, the extra unrestricted network egress is not necessary for core functionality and increases risk in an agent context where untrusted prompts or data may steer execution.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The test suite includes a DingTalk push path that goes beyond passive verification and can trigger a real outbound notification during routine testing. In a customer-data skill, that creates a security and privacy concern because tests can leak customer-derived context to external systems or create unintended side effects in production-like channels.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The guide promotes exporting customer data and transmitting reports or alerts to external services without any privacy, confidentiality, or data-sharing warning. In a sales/customer-support skill, this is especially sensitive because operational reports can contain personal data, conversation content, and performance data that may be subject to contractual or regulatory restrictions.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The setup instructions direct users to copy API credentials into a local JSON file but do not warn about secret exposure, file permissions, accidental commits, or multi-user host risks. In an API automation skill, exposed API keys could allow unauthorized access to customer records, messaging operations, and account-wide business data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The feedback-monitoring example shows customer identifiers, conversation IDs, timestamps, keywords, and message content being sent to a DingTalk webhook without any privacy warning or minimization guidance. In this skill context, that is particularly dangerous because support conversations often contain personal, sensitive, or commercially confidential information, and webhook destinations may expose data to broader audiences than intended.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The README advertises destructive and privacy-impacting capabilities such as deleting WhatsApp devices, ending sessions, querying full chat histories, and assigning conversations without prominent user-facing warnings or confirmation guidance. In an AI-agent skill, these actions may be triggered through natural language, so weak documentation around safeguards increases the chance of unauthorized, accidental, or over-broad actions affecting customer data and live operations.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger set contains broad everyday business words such as '客户', '销售', '分配', '跟进', and '反馈', making accidental invocation likely in ordinary conversation. Because this skill exposes read, write, and potentially destructive business actions, unintended routing into the skill can lead to unauthorized data access or accidental operational changes.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation advertises commands for customer creation, updates, tag changes, order import, session assignment, batch operations, WhatsApp device changes, and deletion, but warning/confirmation guidance is not applied consistently across all destructive or data-affecting commands. In an agent context, inconsistent safeguards increase the chance of unintended bulk actions, customer messaging, reassignment, or deletion with real business impact.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide includes a sample log format that records raw user messages and request parameters, which can contain customer data, chat content, identifiers, or other sensitive business information. In a sales/customer-support skill context, such logging can create unnecessary data exposure through log files, monitoring systems, or downstream retention without any minimization, masking, or access-control guidance.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This section provides concrete examples for querying chat histories, assigning customers, ending sessions, and even sending messages to all VIP customers, but it does not include a clear, general warning about privacy sensitivity, destructive actions, or the need for confirmation before bulk or state-changing operations. In a CRM/WhatsApp/customer-support skill, this increases the chance that an agent follows examples too literally and performs privacy-impacting or operationally disruptive actions without sufficient safeguards.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The document is entirely written as if interaction will occur in Chinese and includes fixed Chinese clarification prompts and examples, without indicating that the assistant should adapt to the user's language. This can cause unintended behavior for non-Chinese users, including misunderstandings around customer operations and confirmations, which is especially problematic for business workflows that depend on precise intent and consent.

Static analysis

No suspicious patterns detected.