GHL CRM for Realtors

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:07 PM UTC
• Version: 1.0.0

Overview

This skill connects to a real CRM with a long-lived token and includes under-scoped commands and troubleshooting steps that could expose credentials or customer data.

Review before installing. Use a narrowly scoped GoHighLevel private integration token, do not run troubleshooting commands that print the token, avoid broad list commands unless you intend to expose CRM records in terminal or agent logs, and require explicit confirmation before deleting records, sending messages, creating invoices, posting publicly, or changing workflows.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: references/troubleshooting.md:15

Finding

Raw API Token Disclosure in Troubleshooting Instructions

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/ghl-api.py:615

Finding

Undeclared Broad and Destructive CRM Capabilities Violate Least Privilege

Content

View full analysis

2 else ""), "list_all_contacts": lambda: list_all_contacts(), "get_contact": lambda: get_contact(sys.argv[2]), "create_contact": lambda: create_contact(sys.argv[2]), "update_contact": lambda: update_contact(sys.argv[2], sys.a ...[truncated 4467 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ghl-api.py:121

Finding

Bulk Contact Retrieval and Automatic PII Output Exceed Minimum Data Requirements

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/setup-wizard.py:144

Finding

Location Identifier Is Interpolated into API Paths Without Validation or Encoding

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/conversations.md (reported line 13)May include surrounding context.

md

| GET | `/conversations/{conversationId}` | Get conversation |
| POST | `/conversations/` | Create conversation |
| PUT | `/conversations/{conversationId}` | Update conversation |
| DELETE | `/conversations/{conversationId}` | Delete conversation |
| POST | `/conversations/messages` | Send message |
| POST | `/conversations/messages/inbound` | Add inbound message |
| POST | `/conversations/messages/upload` | Upload attachment |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 38)May include surrounding context.

text

## OAuth Token Lifecycle (Marketplace Apps Only)
- Access tokens expire in **24 hours** (86,399 seconds)
- Refresh tokens last up to **1 year**
- Private Integration tokens do NOT expire (but 90-day rotation recommended)
- `/oauth/token` is the ONLY endpoint that does NOT require the `Version` header

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes multiple DELETE operations and removal actions that can alter or remove user data, but it does not include any warning about destructive effects, confirmation expectations, or recovery limitations. Under the markdown criteria for missing user warnings, omitting such cautions for data-affecting behaviors is a reportable issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file documents actions that can send messages, upload attachments, and delete conversations or scheduled messages, all of which can affect user data, privacy, or system state. Under the markdown-specific warning rule, the description should include some warning or disclosure about these impactful operations, but none is present in the referenced lines.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The troubleshooting guide includes shell commands that directly print and use a private integration token, but it does not warn that the token is a sensitive secret that must not be logged, shared, or pasted into insecure environments. In agent or support contexts, users often copy commands verbatim, which increases the chance of credential disclosure through terminal history, screenshots, logs, or chat transcripts.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 29)May include surrounding context.

md

--header "Version: 2021-07-28" | head -c 200

# Test POST — Create a contact:
curl --request POST \
  --url https://services.leadconnectorhq.com/contacts/ \
  --header "Authorization: Bearer $HIGHLEVEL_TOKEN" \
  --header "Content-Type: application/json" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The delete_contact function performs a DELETE request that can remove user data, but the code provides no confirmation prompt, warning print/log, or stronger disclosure beyond a brief docstring. For a code file, destructive operations should have some visible user disclosure unless clearly covered elsewhere; this file does not show that for deletion.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The function signature and docstring imply selective tag removal, but the implementation ignores the supplied tags and sends a bare DELETE to the contact tags endpoint. If the upstream API interprets this as removing all tags, callers may unintentionally strip all contact categorization, causing integrity loss and potentially triggering downstream workflow mistakes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

send_message transmits contact identifiers and message content over the network to GoHighLevel, but there is no user-facing disclosure in the function body about sending potentially sensitive communications externally. While network access is part of the helper's purpose, this specific operation handles message content tied to contacts and lacks an explicit warning or notice in the code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The wizard fetches and prints real customer contact data, including names, email addresses, phone numbers, and tags, directly to the terminal without an explicit privacy warning, confirmation, or redaction. In shared terminals, recorded sessions, CI logs, screen shares, or shell history capture environments, this can expose sensitive customer information to unintended viewers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents DELETE endpoints for calendars and appointments, which can affect user data and system integrity, but it provides no warning about the destructive nature of these actions. Under the markdown-specific warning criteria, documentation should note behaviors that may delete or irreversibly modify user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file lists DELETE operations for opportunities and followers, but provides no warning that these actions may remove data or alter records. For markdown files, safety-relevant behaviors that can affect user data or system integrity should include clear warnings or cautions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.