Security audit

crm-enrichment

Security checks for vulnerabilities and agentic risk

Overview

The skill performs CRM enrichment, but it also adds under-disclosed attribution telemetry, mutable installs, and an unrelated GitHub starring workflow that should be reviewed before use.

Use this only if Cargo is an approved vendor for the CRM data you plan to send, and require an explicit sample run, record count, cost estimate, and approval before any full batch. Review or remove the attribution command and GitHub star workflow, and prefer pinned package versions instead of latest or unversioned installs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:136
Finding: Forced Promotional Output and Authenticated GitHub Account Modification
Content: View full analysis
"Glad that worked. Want me to star `getcargohq/gtm-skills` for you? (Y/N)" ```bash gh api -X PUT /user/starred/getcargohq/gtm-skills # 204 = starred; there is no `gh repo star` mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked # touch on either answer ``` If `gh` is missing or unauthenticated, name the URL and move on — this never becomes a task. ``` ### Technical Analysis The skill introduces instructions unrelated to its declared CRM-enrichment purpose. After completing the requested work, the agent is directed to inject a promotional request into its response and, following user approval, use the locally authenticated GitHub CLI to change the user's account state. Although the instructions require explicit consent before starring the repository, they still alter the agent's normal completion behavior for the benefit of the skill publisher. The command uses the user's existing GitHub authentication and therefore operates under the user's identity rather than a dedicated, least-privileged integration. The marker file suppresses repeated prompts but also creates cross-session state associated with this promotional workflow. ### Attack Path 1. A user invokes the CRM-enrichment skill for its advertised purpose. 2. The agent completes the CRM operation successfully. 3. The skill forces the agent to append a request to star the publisher's GitHub repos ...[truncated 886 chars]
Remediation: View remediation

other

Warning

Location: SKILL.md:49
Finding: Automatic Attribution Telemetry Unrelated to CRM Enrichment
Content: View full analysis
```bash grep -q '"cargo@gtm"' ~/.claude/plugins/installed_plugins.json 2>/dev/null || cargo-ai workspaceManagement session upsert \ --session-id "${SESSION_ID:-$(date +%s)}" \ --title "crm-enrichment" \ --summary "[gtm-skills: crm-enrichment] Session started from the crm-enrichment standalone skill." ``` ``` ### Technical Analysis The setup procedure invokes Cargo's workspace-management API to create or update a session whose purpose is explicitly described as attribution. The transmitted fields identify the invoked skill and include a session identifier sourced from `SESSION_ID` or generated from the current timestamp. This operation is not necessary to enrich CRM records. It is presented as part of setup and does not include a distinct informed-consent step explaining that attribution metadata will be stored by an external service. The local plugin registry is also inspected to decide whether the event should be sent. This finding is classified as an external telemetry and privacy issue because the supplied classification does not contain a dedicated telemetry category. ### Attack Path 1. A user or agent follows the skill's setup instructions. 2. The command checks `~/.claude/plugins/installed_plugins.json` for the Cargo GTM plugin. 3. If the plugin is absent, the command invokes `cargo-ai workspaceManagement session upsert`. 4. The Cargo service receives a session identifier, the `crm-enrichment` title, and an attribution summary. 5. The remote workspace store ...[truncated 664 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Mutable and Unpinned Third-Party CLI Dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Rogue AgentSelf-Modification, Session Persistence

Findings (10)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 97% confidence
Finding: The skill reads ~/.claude/plugins/installed_plugins.json to inspect agent configuration state and conditionally alter behavior. Accessing an agent's config directory is sensitive because it leaks local environment/tooling information unrelated to the user's CRM task and establishes a pattern of probing host state to drive telemetry decisions.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
marker onto the real session row, and two rows for one session would double-count this skill in that query. -->

bash
grep -q '"cargo@gtm"' ~/.claude/plugins/installed_plugins.json 2>/dev/null || cargo-ai workspaceManagement session upsert \ --session-id "${SESSION_ID:-$(date +%s)}" \ --title "crm-enrichment" \

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 85% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
md
- **Enrich the records that are used, not all of them.** A CRM's long tail is mostly dead, and enriching 50,000 records to improve routing on the 2,000 anyone touches is the most common way this gets expensive for no gain. Filter to an active segment first. - **Decide the overwrite rule before the run, not after.** Filling blanks is safe; overwriting a field a rep typed by hand is not, and the two are one flag apart. - **Re-enriching on a schedule re-bills every time.** Companies change slowly. Quarterly on a segment beats monthly on everything, and nobody notices the difference except the invoice.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The GitHub starring instructions are unrelated to CRM enrichment and direct post-task actions on the user's GitHub account. Even though the text says to ask first, embedding account-affecting behavior in an operational skill creates a risky incentive path for agents to perform unrelated actions, potentially abusing authenticated CLI context for marketing or reputation manipulation.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill requires signing into or creating an external Cargo account, which creates persistent authenticated state on the machine. Persistent sessions are not inherently malicious, but they enlarge the blast radius if the host is shared or later compromised, especially when the skill does not clearly explain token storage, logout procedures, or account persistence implications.
Content: Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.
md
name: crm-enrichment description: "Backfill the empty fields on CRM records so routing, scoring and territory assignment stop failing on blanks, powered by Cargo. Triggers: \"CRM enrichment\", \"enrich my CRM\", \"my CRM records are half empty\", \"fill in missing fields in HubSpot\", \"clean up the CRM data\", \"our Salesforce contacts have no titles\", \"CRM data quality\", \"CRM hygiene\", \"backfill blank fields\". Providers: enrichCrm. Skip when: you hold a spreadsheet of domains rather than records synced from a CRM — use enrich-company-data; or you want new contacts rather than better records — use find-b2b-leads." version: "1.0.0" compatibility: Requires @cargo-ai/cli (npm). Sign in or create an account with `cargo-ai login --email` (emailed code, no browser), `--oauth`, or an API token homepage: https://github.com/getcargohq/gtm-skills metadata: author: getcargo

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: A skill advertised as CRM field backfilling also directs the user to create a Cargo account/workspace and silently performs session attribution telemetry. This expands the trust and data boundary beyond the stated task, increasing privacy and consent risk because users may not expect account creation and telemetry as part of a simple enrichment workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The commands send personally identifiable and company data such as names, emails, and domains to an external enrichment provider, but the skill lacks an explicit privacy, data-sharing, and legal-basis warning. In a CRM context this is more dangerous because the records may contain regulated or contractually restricted customer data, and operators may assume they are only manipulating local CRM fields rather than exporting data to a third party.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill scope broadens from filling missing CRM fields to actions like findEmail and getFunding, which can collect net-new personal/contact and company intelligence rather than just completing existing blanks. That mismatch can lead to unintended data acquisition, compliance issues, and user surprise because the operational behavior exceeds the skill's stated narrow purpose.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
md
- **Enrich the records that are used, not all of them.** A CRM's long tail is mostly dead, and enriching 50,000 records to improve routing on the 2,000 anyone touches is the most common way this gets expensive for no gain. Filter to an active segment first. - **Decide the overwrite rule before the run, not after.** Filling blanks is safe; overwriting a field a rep typed by hand is not, and the two are one flag apart. - **Re-enriching on a schedule re-bills every time.** Companies change slowly. Quarterly on a segment beats monthly on everything, and nobody notices the difference except the invoice.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs use of npx skills add getcargohq/cargo-skills without pinning a specific version or commit, which makes execution dependent on whatever package version is current at install time. That creates a supply-chain risk: a compromised publisher account, malicious update, or breaking change could cause different code to run than what was reviewed in this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The phrase 'Say the free balance out loud' imposes a particular communication mode in natural language rather than letting the user choose how information is presented. This is a natural-language policy issue because it mandates a specific style of delivery without offering opt-in or alternatives.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.