Security audit

crm-deduplication

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed CRM deduplication workflow that can merge CRM records and send review details to Slack, with explicit approval gates and disabled pilot defaults.

Install only if you want a Cargo CDK workflow that can merge CRM accounts or contacts. Keep the plays disabled until audits, policies, Slack channels, and the exact pilot population are approved; review Slack data-sharing expectations and consider pinning the external cargo-cdk install command.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared purpose describes a full duplicate-management capability: auditing identities, recurring deduplication plays, safe merges, and routing uncertain cases to manual review for both accounts and contacts. The supplied code chunk only defines a data model for CRM contacts and schedules hourly fetching of all contact records. While this could be a supporting component for a deduplication system, by itself it does not perform duplicate detection, scoring, merging, review routing, or account/company handling. Because the actual behavior is materially narrower and different from the declared primary purpose, this is a mismatch.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to run npx skills add getcargohq/cargo-skills --skill cargo-cdk without pinning an exact package version. This can cause users to fetch and execute whatever version is current at install time, increasing supply-chain risk if a future release is compromised or introduces unsafe behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The skill instructs users to run npx skills add ... without pinning a specific package version. This can lead to execution of a newer or compromised package version at install time, creating a supply-chain risk in the operator's environment.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
npx skills add getcargohq/cargo-skills --skill cargo-cdk

text
Read `.agents/skills/cargo-cdk/SKILL.md` directly after installation. Complete its bootstrap and use its authoring, state, plan, and deployment rules throughout this pipeline. 1. **Install it: the CLI does the copy.** From inside the CDK project,

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.
md
### Shared variations | Variation | When it is right | How | What it costs | | ---------------------- | --------------------------------------------- | ----------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | | `crm` | The consumer uses Salesforce or Attio | Replace connector, extract, record ID, search, merge, and properties across selected paths | Generated types and native merge semantics must be revalidated | | `structured_ai_review` | Ambiguous evidence needs a concise review aid | Add priced structured evidence before Human Review only; never use it to bypass deterministic guards | Adds model cost and a non-deterministic review surface |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.
md
### Path 1: Account variations | Variation | When it is right | How | What it costs | | ----------------------------- | --------------------------------------------------------------- | ------------------------------------------------------------------------------------ | ----------------------------------------------------------------- | | `account_matching_keys` | The CRM has another approved durable company identity | Add it to search, normalization, evidence, conflict gates, review, and contract tests | Wider matching can create new false-positive company classes | | `account_survivor_precedence` | Protected lifecycle, billing, tier, or customer policy must win | Change the account ranker and its contract fixtures together | A policy change can select a different survivor for every cluster |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.
md
### Path 2: Contact variations | Variation | When it is right | How | What it costs | | ----------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------------------- | --------------------------------------------------------------- | | `contact_matching_keys` | The CRM has another approved durable person identity | Add it to both searches, normalization, evidence, conflict gates, review, and tests | Wider matching can create new false-positive person classes | | `contact_survivor_precedence` | Commercial history or activity policy differs | Change the contact ranker and its contract fixtures together | A policy change can select a different survivor for every group |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow automatically merges CRM contacts whenever the score meets the threshold and evidence.autoEligible is true, without an explicit user-facing confirmation step for that action. In a deduplication skill, merges are inherently destructive because they can irreversibly combine records, overwrite fields, or collapse distinct people who merely share identifiers, so a bad match or poisoned input can cause data integrity loss at scale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code builds reviewLines for a Slack review message using contact IDs, names, email addresses, LinkedIn IDs, job titles, and company IDs. This is a network-bound/data-sharing operation involving personal data, but the file provides no confirmation prompt, user-facing log/disclosure, or warning comment explaining that these fields will be sent to Slack.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 94)May include surrounding context.
md
Use only normalized LinkedIn company ID, LinkedIn URL or handle, and non-generic domain as candidate keys. Company name alone is not a candidate key and never contributes to the score. | Candidate | Execution path | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | Exact LinkedIn company ID on every record, with no conflicting identity, protected ID, or parent-subsidiary relationship | Automatic merge after score and fresh CRM search | | LinkedIn URL or handle only | Human Review |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 97)May include surrounding context.
md
| Candidate | Execution path | | ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | Exact LinkedIn company ID on every record, with no conflicting identity, protected ID, or parent-subsidiary relationship | Automatic merge after score and fresh CRM search | | LinkedIn URL or handle only | Human Review | | Domain only | Human Review | | Junk or shared domain | Ignore as a key; another supported key determines the route | | Parent, subsidiary, brand, division, or regional entity | Human Review |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 98)May include surrounding context.
md
| ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | | Exact LinkedIn company ID on every record, with no conflicting identity, protected ID, or parent-subsidiary relationship | Automatic merge after score and fresh CRM search | | LinkedIn URL or handle only | Human Review | | Domain only | Human Review | | Junk or shared domain | Ignore as a key; another supported key determines the route | | Parent, subsidiary, brand, division, or regional entity | Human Review | | Conflicting identity or protected ID | Human Review or decline |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 99)May include surrounding context.
md
| Exact LinkedIn company ID on every record, with no conflicting identity, protected ID, or parent-subsidiary relationship | Automatic merge after score and fresh CRM search | | LinkedIn URL or handle only | Human Review | | Domain only | Human Review | | Junk or shared domain | Ignore as a key; another supported key determines the route | | Parent, subsidiary, brand, division, or regional entity | Human Review | | Conflicting identity or protected ID | Human Review or decline | | AI-assisted judgement | Evidence for Human Review only |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 102)May include surrounding context.
md
| Exact LinkedIn company ID on every record, with no conflicting identity, protected ID, or parent-subsidiary relationship | Automatic merge after score and fresh CRM search | | LinkedIn URL or handle only | Human Review | | Domain only | Human Review | | Junk or shared domain | Ignore as a key; another supported key determines the route | | Parent, subsidiary, brand, division, or regional entity | Human Review | | Conflicting identity or protected ID | Human Review or decline | | AI-assisted judgement | Evidence for Human Review only |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 101)May include surrounding context.
md
| Domain only | Human Review | | Junk or shared domain | Ignore as a key; another supported key determines the route | | Parent, subsidiary, brand, division, or regional entity | Human Review | | Conflicting identity or protected ID | Human Review or decline | | AI-assisted judgement | Evidence for Human Review only | Count `identity_conflict` and `protected_id_conflict` separately. Present detected billing,

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/audit.md (reported line 219)May include surrounding context.
md
| Domain only | Human Review | | Junk or shared domain | Ignore as a key; another supported key determines the route | | Parent, subsidiary, brand, division, or regional entity | Human Review | | Conflicting identity or protected ID | Human Review or decline | | AI-assisted judgement | Evidence for Human Review only | Count `identity_conflict` and `protected_id_conflict` separately. Present detected billing,

Static analysis

No suspicious patterns detected.