Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- lib/runtime.js:145
- Evidence
|| process.env.MAUTIC_ALLOW_MAINTENANCE_COMMANDS !== undefined
Security audit
Mautic Control
Security checks for vulnerabilities and agentic risk
Overview
The CRM integration fits its purpose, but its optional file tools can follow symbolic links outside the folder they promise to use.
Keep workspace file access disabled until symbolic-link containment is fixed, or run it in an isolated environment without sensitive files reachable. Use least-privilege Mautic credentials, explicit tool allowlists, and a private console bridge. The configured staging folder currently provides an incomplete security boundary.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access