Bitrix24 REST API

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 1.2.1

Overview

This Bitrix24 skill is not malicious, but it gives an agent broad automatic access to sensitive CRM, employee, chat, calendar, drive, and feed data through a webhook.

Install only with a dedicated least-privilege Bitrix24 webhook. Avoid broad all-module scopes unless you truly want the agent to access CRM, tasks, chats, files, employee status, and feeds. Consider disabling implicit invocation or using explicit Bitrix24 prompts, and require manual review before any write, delete, feed post, chat message, batch mutation, or scheduled report.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Intent-Code Divergence

Medium

• Confidence: 77% confidence
• Finding: The file claims write/delete actions always require explicit confirmation, but later promotes scheduled automations that can send outputs automatically. This inconsistency can erode operator expectations about when actions happen without interaction and may lead to unintended automated disclosure or execution in future extensions.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger list contains broad everyday terms that can cause implicit activation on ordinary conversation. Because this skill immediately performs Bitrix24 read operations on activation, over-broad matching can expose CRM, calendar, tasks, or employee data without the user deliberately invoking the skill.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Several generic trigger phrases make the invocation boundary ambiguous, increasing the chance that unrelated user messages activate the skill. In this context, accidental activation is more dangerous because the instructions say read requests should execute immediately using the configured webhook.

Vague Triggers

Low

• Confidence: 79% confidence
• Finding: Broad scenario phrases can over-match natural language and trigger bundled multi-call workflows. Even if the impact is lower than explicit write abuse, automatic cross-domain retrieval increases unnecessary access and disclosure of business data.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest enables implicit invocation for a high-privilege integration that can access CRM, tasks, chat, calendar, drive, and organizational data, but it does not define visible trigger constraints, scoping rules, or exclusion conditions in the file itself. This increases the chance the skill is auto-selected in loosely related conversations and may cause unintended actions or data exposure using the configured Bitrix24 webhook context.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill declares a sensitive credential input (BITRIX24_WEBHOOK_URL), which likely grants authenticated API access to Bitrix24, but the manifest provides no user-facing disclosure about the sensitivity, scope, or risks of that secret. In a skill that can touch CRM records, chats, files, and employee data, lack of transparency can lead to unsafe deployment, over-privileged credentials, and accidental exposure or misuse.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The install-callback section instructs operators to save access and refresh tokens but does not explain that these are sensitive credentials requiring protected storage, access controls, and log redaction. In a skill centered on API integrations, such omissions can lead implementers to persist long-lived tokens insecurely, increasing risk of account compromise if storage or logs are exposed.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The instruction to query the remote MCP documentation server omits any warning that search terms may be sent off-system to an external service. In an agent setting, user prompts, object names, customer names, or internal project identifiers can be embedded in queries, causing unintended disclosure of sensitive metadata to a third party.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document lists destructive CRM methods such as `crm.deal.delete` alongside read/write methods without any caution, confirmation guidance, or safer alternatives. In an agent skill that may translate natural-language requests into API actions, documenting deletion as a normal operation increases the risk of accidental or unauthorized destructive actions against production CRM data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Including `crm.contact.delete` without warning is dangerous because contacts often contain critical customer data and relationship links that may be hard to recover. In a CRM automation context, an LLM agent could invoke this based on ambiguous user phrasing and permanently remove records or break downstream workflows.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Documenting `crm.company.delete` without any warning or guardrail can lead to deletion of organization-level records that may be referenced by deals, contacts, and reporting. Because this skill is designed for operational CRM use, the omission makes accidental high-impact data loss more likely.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: `crm.lead.delete` is presented as a standard method without warning about irreversible changes, which is risky in sales environments where leads feed attribution, analytics, and follow-up processes. In an autonomous or semi-autonomous agent workflow, this can cause avoidable business-data destruction from simple prompt mistakes.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Listing `crm.activity.delete` without warning can erase audit-relevant task or communication history tied to CRM entities. Even if less severe than deleting primary records, removing activities can impair accountability, sales context, and compliance evidence.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The generalized APIs include both `crm.item.delete` and `crm.item.batchImport` without warning about integrity and scale risks. For smart processes and custom entities, these operations can cause bulk corruption, mass overwrites, or large-scale deletion across portal-specific business objects, making them more dangerous than single-record CRUD examples.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation normalizes broad feed-posting actions, including examples that target `UA` (all authorized users) and explicitly states the default recipient is everyone, without any caution about accidental mass disclosure or unintended organization-wide notifications. In an agent skill context, this increases the chance that an automated workflow posts sensitive or incorrect content to a very wide audience due to omission of explicit recipient scoping.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation includes a destructive `crm.item.productrow.set` example that replaces all existing product rows, but it does not give a strong pre-execution warning or require verification steps immediately around the command. In an agent skill context, this is dangerous because an LLM-driven workflow may translate a vague request into a full replacement operation, causing unintended loss or corruption of deal line items.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The file lists delete-capable endpoints such as `crm.product.delete` and `crm.productsection.delete` without any user-facing caution about their destructive effect. While simple API references commonly enumerate such methods, in an agent-integrated skill this increases the chance that the assistant may invoke deletion without highlighting irreversibility or obtaining clear confirmation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file includes concrete examples for creating tasks, adding checklist items, and posting comments, but it does not warn that these operations modify live user data or require explicit user confirmation. In an agent skill, this increases the chance that an automated system will perform state-changing actions based on ambiguous prompts, leading to unintended task creation, edits, or deletions in a real Bitrix24 workspace.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document explicitly describes methods for retrieving other users' absence reports and department user lists, and later provides examples using arbitrary USER_ID and DEPARTMENT_ID values. Even though it notes that access depends on role, it lacks any privacy, authorization, or least-privilege warning, which can normalize sensitive employee monitoring and encourage overbroad data access in agent behavior.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill documents both retrieval and modification of office network ranges, including the ability to set trusted IP ranges, without warning that these settings can affect attendance validation and location-based work controls. In an automation context, exposing configuration-changing methods without caution increases the risk of accidental or unauthorized policy changes that could weaken timekeeping integrity.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The team-status workflow directs automatic retrieval of department membership, employee task counts, overdue items, and work-status data without minimization or role-based checks. This can expose sensitive workforce and performance information beyond what is necessary for many requests, especially under implicit invocation rules.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The client dossier workflow aggregates contact/company identity, phone, email, active deals, and activity history into a default bundle. This creates a high-risk concentration of personal and commercial data that could be disclosed too broadly if the skill is triggered accidentally, used by an over-privileged webhook, or queried with a vague match.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The meeting-prep flow instructs default disclosure of attendee identities, roles, companies, and related deals. Combining calendar and CRM context can reveal sensitive relationship and commercial information to any user operating under the webhook's privileges, even when only basic meeting context was requested.

Credential Access

High

• Category: Privilege Escalation

Content

### Security
- Three-level encrypted storage for webhook:
  1. OS keychain (macOS Keychain, Windows Credential Vault, Linux SecretService) — webhook never on disk
  2. AES-256 encrypted file via `keyrings.alt` EncryptedKeyring — for containers and headless servers
  3. Plaintext config with permissions 600 — fallback when encryption packages unavailable
- Agent auto-installs `keyring`, `keyrings.alt`, `pycryptodome` when falling back to plaintext

• Confidence: 90% confidence
• Finding: The mention of OS keychain itself is not dangerous, but the same documented storage model includes an insecure plaintext fallback for the webhook. Because the credential is a high-value API secret for Bitrix24, any design advertising fallback to disk storage creates meaningful exposure if operators follow it.

Credential Access

High

• Category: Privilege Escalation

Content

### Security
- Three-level encrypted storage for webhook:
  1. OS keychain (macOS Keychain, Windows Credential Vault, Linux SecretService) — webhook never on disk
  2. AES-256 encrypted file via `keyrings.alt` EncryptedKeyring — for containers and headless servers
  3. Plaintext config with permissions 600 — fallback when encryption packages unavailable
- Agent auto-installs `keyring`, `keyrings.alt`, `pycryptodome` when falling back to plaintext

• Confidence: 90% confidence
• Finding: The mention of OS keychain itself is not dangerous, but the same documented storage model includes an insecure plaintext fallback for the webhook. Because the credential is a high-value API secret for Bitrix24, any design advertising fallback to disk storage creates meaningful exposure if operators follow it.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.