Pipedrive CRM (OpenClaw)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:03 PM UTC
• Version: 0.1.0

Overview

The skill is a coherent Pipedrive CRM helper, but it can modify or delete live CRM data and has credential-handling risks users should review before installing.

Install only if you want an agent to operate on live Pipedrive data. Use the least-privileged credential available, avoid setting PIPEDRIVE_API_BASE unless you fully trust and verify the destination, do not run the setup wizard in shared or recorded terminals, and require manual review before delete, raw request, or bulk update actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-wizard.py:14

Finding

Credentials Exposed Through Echoing Interactive Prompts

Content

View full analysis

str: suffix = f" [{default}]" if default else "" value = input(f"{label}{suffix}: ").strip() return value or default ``` The vulnerable helper is used directly for both supported credential types: ```python token = _prompt("PIPEDRIVE_API_TOKEN", os.environ.get("PIPEDRIVE_API_TOKEN", "")) ``` ```python access_token = _prompt("PIPEDRIVE_ACCESS_TOKEN", os.environ.get("PIPEDRIVE_ACCESS_TOKEN", "")) ``` ### Technical Analysis The `_prompt` function uses the ordinary `input()` function for secrets. This causes newly entered API tokens and OAuth access tokens to remain visible while the user types them. More critically, when a credential is already present in the environment, it is passed as `default` and interpolated into the prompt through: ```python suffix = f" [{default}]" if default else "" ``` Consequently, the complete credential is printed to the terminal before the user enters anything. This behavior conflicts with the rule in `SKILL.md` stating that raw tokens must never be printed or echoed. Although the setup wizard legitimately needs a token to validate the Pipedrive connection, displaying that token is unnecessary and exceeds minimum credential-handling requirements. ### Attack Path 1. A valid credential is stored in `PIPEDRIVE_API_TOKEN` or `PIPEDRIVE_ACCESS_TOKEN`. 2. The user or an automation environment runs `scripts/setup-wizard.py` as documented. 3. The corresponding environment value is passed to `_prompt` as its default. 4. `_prompt` embeds the complete token in the visible terminal prompt. 5. The credential is captured through terminal scrollback, session recording, CI logs, screenshots, screen sharing ...[truncated 900 chars]

Remediation

View remediation

str: if existing: reuse = input(f"{label} is already configured. Reuse it? [Y/n]: ").strip().lower() if reuse in {"", "y", "yes"}: return existing return getpass.getpass(f"{label}: ").strip() ``` 2. Never display an existing credential as a prompt default. Indicate only whether it is configured. 3. Avoid logging, printing, or returning raw credentials in success and error messages. 4. Where practical, avoid interactive token entry entirely and require secrets to be supplied through a protected secret manager or environment variable. 5. Add tests that populate the credential environment variables and verify that captured stdout and stderr do not contain their values. 6. Document terminal-recording and process-environment risks for users operating in shared or automated environments. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pipedrive-api.py:51

Finding

Unvalidated API Base Override Can Redirect Authentication Credentials

Content

View full analysis

str: custom = _env("PIPEDRIVE_API_BASE") if custom: return custom.rstrip("/") company = _env("PIPEDRIVE_COMPANY_DOMAIN") if not company: raise ValueError( "Missing PIPEDRIVE_COMPANY_DOMAIN (or set PIPEDRIVE_API_BASE explicitly)." ) if not re.match(r"^[a-zA-Z0-9-]{1,100}$", company): raise ValueError("Invalid PIPEDRIVE_COMPANY_DOMAIN format.") return f"https://{company}.pipedrive.com/api/v1" ``` OAuth credentials are attached to the request headers, while API tokens are attached to the query string: ```python def _auth_headers() -> Dict[str, str]: token = _env("PIPEDRIVE_ACCESS_TOKEN") if token: return {"Authorization": f"Bearer {token}"} return {} def _auth_query() -> Dict[str, str]: bearer = _env("PIPEDRIVE_ACCESS_TOKEN") if bearer: return {} api_token = _env("PIPEDRIVE_API_TOKEN") if not api_token: raise ValueError( "Set either PIPEDRIVE_ACCESS_TOKEN (OAuth) or PIPEDRIVE_API_TOKEN (token auth)." ) return {"api_token": api_token} ``` The configured base and authentication material are then combined for every request: ```python def _build_url(path: str, query: Optional[Dict[str, Any]] = None) -> str: base = _base_url() clean_path = path if path.startswith("/") else f"/{path}" query_items: Dict[str, Any] = {} if query: query_items.update(query) query_items.update(_auth_query()) encoded = urllib.parse.urlencode({k: v for k, v in query_items.items() if v is not None}) ...[truncated 3868 chars]

Remediation

View remediation

str: parsed = urllib.parse.urlparse(raw) if parsed.scheme != "https": raise ValueError("PIPEDRIVE_API_BASE must use HTTPS.") if parsed.username or parsed.password or parsed.fragment: raise ValueError("PIPEDRIVE_API_BASE contains forbidden URL components.") if parsed.port not in {None, 443}: raise ValueError("PIPEDRIVE_API_BASE uses an unsupported port.") host = (parsed.hostname or "").lower().rstrip(".") if host != "api.pipedrive.com" and not host.endswith(".pipedrive.com"): raise ValueError("PIPEDRIVE_API_BASE must use an approved Pipedrive host.") if parsed.path.rstrip("/") != "/api/v1": raise ValueError("PIPEDRIVE_API_BASE must target /api/v1.") return raw.rstrip("/") ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises operational scripts that use environment variables for credentials and make network calls to a live CRM API, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes execution boundaries implicit rather than enforced, increasing the chance the agent can invoke networked actions or access secrets in contexts broader than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The description and usage guidance are broad enough to match many generic CRM-related user requests, and the skill includes high-impact capabilities such as create, update, delete, and raw request forwarding. In an agent environment, vague invocation boundaries can cause the skill to be selected for ambiguous prompts and perform unintended modifications to customer data or workflow state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The playbook explicitly instructs deletion workflow steps but does not require an explicit user confirmation immediately before the destructive action. In an agent skill that manages live CRM records, this omission increases the chance of accidental or unintended record deletion, especially if an upstream prompt or ambiguous user request triggers the workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/pipedrive-v1-notes.md (reported line 11)May include surrounding context.

md

Alternative global base (if account setup supports it):

- `https://api.pipedrive.com/api/v1`

## Authentication

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The delete command performs a record deletion via an HTTP DELETE request, but the function and surrounding code provide no confirmation prompt or explicit warning about the destructive action. While the subcommand is named "delete," there is no additional user disclosure in code comments, docstrings, or runtime output to warn that the action may be irreversible.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.