Security audit

crm-deduplication

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed CRM deduplication skill that can merge records and send review details to Slack, with audits, disabled pilots, and explicit approvals built into the workflow.

Install only in a Cargo project where the CRM and Slack connectors are approved for this use. Pin or verify the installer/tooling versions if supply-chain control matters, confirm the review channel and data-sharing expectations, keep the plays disabled until audit and pilot approvals are recorded, and verify the 15-row/no-concurrency limits before any run.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code substantially matches part of the description: it performs recurring CRM deduplication, evaluates person identity signals, auto-merges safe matches, and routes uncertain cases to human review in Slack. However, the declared purpose presents a broader capability set than this code actually implements. This chunk only handles contact deduplication (objectType: "contacts") and contains no company/account deduplication logic. It also operates on a specific contacts model rather than broadly on both CRM accounts and contacts. These are material scope gaps, so the description is not fully accurate for the supplied code chunk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx skills add getcargohq/cargo-skills --skill cargo-project without pinning an exact package version. That allows execution of whatever package version is current at install time, which can introduce supply-chain risk if a malicious or compromised release is published later. In this skill context, that risk is more significant because the package is an authoring skill used before planning or deploying CRM workflows, so a compromised dependency could affect developer environments or project configuration.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 80% confidence
Finding: The skill instructs users to run npx skills add ... without pinning a specific version or immutable source. That can pull whatever package/version is current at execution time, creating a supply-chain risk where a compromised or unexpected package release could execute code during install in the operator environment.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
npx skills add getcargohq/cargo-skills --skill cargo-project

text
Read `.agents/skills/cargo-project/SKILL.md` directly after installation. Complete its bootstrap and use its authoring, state, plan, and deployment rules throughout this pipeline. 1. **Install it: the CLI does the copy.** From inside the project (the folder holding `cargo.json`),

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.
md
### Shared variations | Variation | When it is right | How | What it costs | | ---------------------- | --------------------------------------------- | ----------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | | `crm` | The consumer uses Salesforce or Attio | Replace connector, extract, record ID, search, merge, and properties across selected paths | Generated types and native merge semantics must be revalidated | | `structured_ai_review` | Ambiguous evidence needs a concise review aid | Add priced structured evidence before Human Review only; never use it to bypass deterministic guards | Adds model cost and a non-deterministic review surface |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.
md
### Path 1: Account variations | Variation | When it is right | How | What it costs | | ----------------------------- | --------------------------------------------------------------- | ------------------------------------------------------------------------------------ | ----------------------------------------------------------------- | | `account_matching_keys` | The CRM has another approved durable company identity | Add it to search, normalization, evidence, conflict gates, review, and contract tests | Wider matching can create new false-positive company classes | | `account_survivor_precedence` | Protected lifecycle, billing, tier, or customer policy must win | Change the account ranker and its contract fixtures together | A policy change can select a different survivor for every cluster |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.
md
### Path 2: Contact variations | Variation | When it is right | How | What it costs | | ----------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------------------- | --------------------------------------------------------------- | | `contact_matching_keys` | The CRM has another approved durable person identity | Add it to both searches, normalization, evidence, conflict gates, review, and tests | Wider matching can create new false-positive person classes | | `contact_survivor_precedence` | Commercial history or activity policy differs | Change the contact ranker and its contract fixtures together | A policy change can select a different survivor for every group |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 94)May include surrounding context.
md
Use only normalized LinkedIn company ID, LinkedIn URL or handle, and non-generic domain as candidate keys. Company name alone is not a candidate key and never contributes to the score. | Candidate | Execution path | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | Exact LinkedIn company ID on every record, with no conflicting identity, protected ID, or parent-subsidiary relationship | Automatic merge after score and fresh CRM search | | LinkedIn URL or handle only | Human Review |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 97)May include surrounding context.
md
| Candidate | Execution path | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | Exact LinkedIn company ID on every record, with no conflicting identity, protected ID, or parent-subsidiary relationship | Automatic merge after score and fresh CRM search | | LinkedIn URL or handle only | Human Review | | Domain only | Human Review | | Junk or shared domain | Ignore as a key; another supported key determines the route | | Parent, subsidiary, brand, division, or regional entity | Human Review |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 98)May include surrounding context.
md
| ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | Exact LinkedIn company ID on every record, with no conflicting identity, protected ID, or parent-subsidiary relationship | Automatic merge after score and fresh CRM search | | LinkedIn URL or handle only | Human Review | | Domain only | Human Review | | Junk or shared domain | Ignore as a key; another supported key determines the route | | Parent, subsidiary, brand, division, or regional entity | Human Review | | Conflicting identity or protected ID | Human Review or decline |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 99)May include surrounding context.
md
| Exact LinkedIn company ID on every record, with no conflicting identity, protected ID, or parent-subsidiary relationship | Automatic merge after score and fresh CRM search | | LinkedIn URL or handle only | Human Review | | Domain only | Human Review | | Junk or shared domain | Ignore as a key; another supported key determines the route | | Parent, subsidiary, brand, division, or regional entity | Human Review | | Conflicting identity or protected ID | Human Review or decline | | AI-assisted judgement | Evidence for Human Review only |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 102)May include surrounding context.
md
| Exact LinkedIn company ID on every record, with no conflicting identity, protected ID, or parent-subsidiary relationship | Automatic merge after score and fresh CRM search | | LinkedIn URL or handle only | Human Review | | Domain only | Human Review | | Junk or shared domain | Ignore as a key; another supported key determines the route | | Parent, subsidiary, brand, division, or regional entity | Human Review | | Conflicting identity or protected ID | Human Review or decline | | AI-assisted judgement | Evidence for Human Review only |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 101)May include surrounding context.
md
| Domain only | Human Review | | Junk or shared domain | Ignore as a key; another supported key determines the route | | Parent, subsidiary, brand, division, or regional entity | Human Review | | Conflicting identity or protected ID | Human Review or decline | | AI-assisted judgement | Evidence for Human Review only | Count `identity_conflict` and `protected_id_conflict` separately. Present detected billing,

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 219)May include surrounding context.
md
| Domain only | Human Review | | Junk or shared domain | Ignore as a key; another supported key determines the route | | Parent, subsidiary, brand, division, or regional entity | Human Review | | Conflicting identity or protected ID | Human Review or decline | | AI-assisted judgement | Evidence for Human Review only | Count `identity_conflict` and `protected_id_conflict` separately. Present detected billing,

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The code constructs review lines for a Slack message containing names, email addresses, LinkedIn identifiers, job titles, and company IDs. Although this is likely part of the skill's purpose, this file itself provides only an internal comment and no user-facing warning, log, or disclosure that contact data will be sent to Slack for review.
Content: No source excerpt is available for this finding.