Pipedrive CRM (OpenClaw)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:03 PM UTC
• Version: 0.1.0

Overview

The skill is a coherent Pipedrive CRM helper, but it can modify or delete live CRM data and has credential-handling risks users should review before installing.

Install only if you want an agent to operate on live Pipedrive data. Use the least-privileged credential available, avoid setting PIPEDRIVE_API_BASE unless you fully trust and verify the destination, do not run the setup wizard in shared or recorded terminals, and require manual review before delete, raw request, or bulk update actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-wizard.py:14
• Finding: Credentials Exposed Through Echoing Interactive Prompts<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-wizard.py`, lines 14-16, with credential-prompt invocations at lines 46 and 59 **Vulnerability Type**: Sensitive credential exposure through terminal output **Risk Level**: Medium ### Vulnerable Code ```python def _prompt(label: str, default: str = "") -> str: suffix = f" [{default}]" if default else "" value = input(f"{label}{suffix}: ").strip() return value or default ``` The vulnerable helper is used directly for both supported credential types: ```python token = _prompt("PIPEDRIVE_API_TOKEN", os.environ.get("PIPEDRIVE_API_TOKEN", "")) ``` ```python access_token = _prompt("PIPEDRIVE_ACCESS_TOKEN", os.environ.get("PIPEDRIVE_ACCESS_TOKEN", "")) ``` ### Technical Analysis The `_prompt` function uses the ordinary `input()` function for secrets. This causes newly entered API tokens and OAuth access tokens to remain visible while the user types them. More critically, when a credential is already present in the environment, it is passed as `default` and interpolated into the prompt through: ```python suffix = f" [{default}]" if default else "" ``` Consequently, the complete credential is printed to the terminal before the user enters anything. This behavior conflicts with the rule in `SKILL.md` stating that raw tokens must never be printed or echoed. Although the setup wizard legitimately needs a token to validate the Pipedrive connection, displaying that token is unnecessary and exceeds minimum credential-handling requirements. ### Attack Path 1. A valid credential is stored in `PIPEDRIVE_API_TOKEN` or `PIPEDRIVE_ACCESS_TOKEN`. 2. The user or an automation environment runs `scripts/setup-wizard.py` as documented. 3. The corresponding environment value is passed to `_prompt` as its default. 4. `_prompt` embeds the complete token in the visible terminal prompt. 5. The credential is captured through terminal scrollback, session recording, CI logs, screenshots, screen sharing ...[truncated 900 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `input()` with `getpass.getpass()` whenever a credential must be entered: ```python import getpass def _prompt_secret(label: str, existing: str = "") -> str: if existing: reuse = input(f"{label} is already configured. Reuse it? [Y/n]: ").strip().lower() if reuse in {"", "y", "yes"}: return existing return getpass.getpass(f"{label}: ").strip() ``` 2. Never display an existing credential as a prompt default. Indicate only whether it is configured. 3. Avoid logging, printing, or returning raw credentials in success and error messages. 4. Where practical, avoid interactive token entry entirely and require secrets to be supplied through a protected secret manager or environment variable. 5. Add tests that populate the credential environment variables and verify that captured stdout and stderr do not contain their values. 6. Document terminal-recording and process-environment risks for users operating in shared or automated environments. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pipedrive-api.py:51
• Finding: Unvalidated API Base Override Can Redirect Authentication Credentials<![CDATA[ ## Vulnerability Details **File Location**: `scripts/pipedrive-api.py`, lines 51-54, with credential attachment and request execution at lines 67-84 and 123-151 **Vulnerability Type**: Credential forwarding to an untrusted configurable destination **Risk Level**: Medium ### Vulnerable Code The API base override is returned without validating its scheme, hostname, port, or path: ```python def _base_url() -> str: custom = _env("PIPEDRIVE_API_BASE") if custom: return custom.rstrip("/") company = _env("PIPEDRIVE_COMPANY_DOMAIN") if not company: raise ValueError( "Missing PIPEDRIVE_COMPANY_DOMAIN (or set PIPEDRIVE_API_BASE explicitly)." ) if not re.match(r"^[a-zA-Z0-9-]{1,100}$", company): raise ValueError("Invalid PIPEDRIVE_COMPANY_DOMAIN format.") return f"https://{company}.pipedrive.com/api/v1" ``` OAuth credentials are attached to the request headers, while API tokens are attached to the query string: ```python def _auth_headers() -> Dict[str, str]: token = _env("PIPEDRIVE_ACCESS_TOKEN") if token: return {"Authorization": f"Bearer {token}"} return {} def _auth_query() -> Dict[str, str]: bearer = _env("PIPEDRIVE_ACCESS_TOKEN") if bearer: return {} api_token = _env("PIPEDRIVE_API_TOKEN") if not api_token: raise ValueError( "Set either PIPEDRIVE_ACCESS_TOKEN (OAuth) or PIPEDRIVE_API_TOKEN (token auth)." ) return {"api_token": api_token} ``` The configured base and authentication material are then combined for every request: ```python def _build_url(path: str, query: Optional[Dict[str, Any]] = None) -> str: base = _base_url() clean_path = path if path.startswith("/") else f"/{path}" query_items: Dict[str, Any] = {} if query: query_items.update(query) query_items.update(_auth_query()) encoded = urllib.parse.urlencode({k: v for k, v in query_items.items() if v is not None}) ...[truncated 3868 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse the override with `urllib.parse.urlparse()` and reject malformed values. 2. Require the `https` scheme. 3. Reject embedded usernames, passwords, fragments, unexpected ports, and ambiguous hostnames. 4. Restrict credential-bearing requests to documented Pipedrive hosts: - `api.pipedrive.com` - Valid tenant hosts ending in `.pipedrive.com` 5. Require the path to end in or explicitly match `/api/v1`. 6. Compare normalized hostnames rather than using substring matching. 7. Refuse redirects that cross to a different hostname, because redirect handling can otherwise forward or expose sensitive request information. 8. If support for a private proxy is essential, require a separate explicit opt-in setting, present the normalized destination for confirmation, and document that credentials will be shared with that proxy. 9. Add regression tests covering malicious values such as: - `http://attacker.example/api/v1` - `https://pipedrive.com.attacker.example/api/v1` - `https://user:[e-mail]/api/v1` - Non-API paths and unexpected ports An allowlisted implementation should follow this pattern: ```python def _validated_custom_base(raw: str) -> str: parsed = urllib.parse.urlparse(raw) if parsed.scheme != "https": raise ValueError("PIPEDRIVE_API_BASE must use HTTPS.") if parsed.username or parsed.password or parsed.fragment: raise ValueError("PIPEDRIVE_API_BASE contains forbidden URL components.") if parsed.port not in {None, 443}: raise ValueError("PIPEDRIVE_API_BASE uses an unsupported port.") host = (parsed.hostname or "").lower().rstrip(".") if host != "api.pipedrive.com" and not host.endswith(".pipedrive.com"): raise ValueError("PIPEDRIVE_API_BASE must use an approved Pipedrive host.") if parsed.path.rstrip("/") != "/api/v1": raise ValueError("PIPEDRIVE_API_BASE must target /api/v1.") return raw.rstrip("/") ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises operational scripts that use environment variables for credentials and make network calls to a live CRM API, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes execution boundaries implicit rather than enforced, increasing the chance the agent can invoke networked actions or access secrets in contexts broader than intended.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The description and usage guidance are broad enough to match many generic CRM-related user requests, and the skill includes high-impact capabilities such as create, update, delete, and raw request forwarding. In an agent environment, vague invocation boundaries can cause the skill to be selected for ambiguous prompts and perform unintended modifications to customer data or workflow state.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The playbook explicitly instructs deletion workflow steps but does not require an explicit user confirmation immediately before the destructive action. In an agent skill that manages live CRM records, this omission increases the chance of accidental or unintended record deletion, especially if an upstream prompt or ambiguous user request triggers the workflow.

External Transmission

Medium

• Category: Data Exfiltration

Content

Alternative global base (if account setup supports it):

- `https://api.pipedrive.com/api/v1`

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The delete command performs a record deletion via an HTTP DELETE request, but the function and surrounding code provide no confirmation prompt or explicit warning about the destructive action. While the subcommand is named "delete," there is no additional user disclosure in code comments, docstrings, or runtime output to warn that the action may be irreversible.

Static analysis

No suspicious patterns detected.