Attio Apikey

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:22 PM UTC
• Version: 1.0.1

Overview

This is a real Attio CRM client, but it gives an agent broad read/write/delete access with weak scoping and no delete safeguard.

Install only if you are comfortable giving this skill a dedicated, least-privilege Attio API key. Treat it as capable of broad Attio reads and writes, verify record IDs before any update or delete, avoid autonomous use of deletion, and avoid --all on large objects until pagination is fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: attio_client.py:214

Finding

Broken Pagination Causes Unbounded API Requests and Memory Consumption

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tainted flow: 'request' from os.environ.get (line 56, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · attio_client.py (reported line 62)May include surrounding context.

python

request.data = json.dumps(data).encode("utf-8")
    
    try:
        with urlopen(request, timeout=timeout) as response:
            body = response.read().decode("utf-8")
            if body:
                return json.loads(body)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

2. Copy the env template:

   bash

   cp .env.example .env
   

3. Add your API key:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

3. Add your API key:

   bash

   # Edit .env and replace with your key
   ATTIO_API_KEY="your-key-here"
   

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · attio_client.py (reported line 31)May include surrounding context.

python

3. **Add your API key:**
   ```bash
   # Edit .env and replace with your key
   ATTIO_API_KEY="your-key-here"
   ```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · attio_client.py (reported line 41)May include surrounding context.

python

3. **Add your API key:**
   ```bash
   # Edit .env and replace with your key
   ATTIO_API_KEY="your-key-here"
   ```

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared behavior limits the skill to companies, people, and notes, but the implementation reportedly supports broader Attio resources and arbitrary raw endpoint access. This mismatch is dangerous because users may authorize the skill believing it has narrow CRM functionality while it can access or modify additional data types and endpoints.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

## Setup

1. Get API key from https://app.attio.com/settings/api
2. Copy `.env.example` to `.env` and add your key

## Quick Commands

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · attio_client.py (reported line 32)May include surrounding context.

python

API_KEY = os.environ.get("ATTIO_API_KEY", "")
if not API_KEY:
    # Fallback: read from .env file
    env_path = os.path.join(os.path.dirname(__file__), ".env")
    if os.path.exists(env_path):
        with open(env_path) as f:
            for line in f:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file describes a --delete option for removing records, but it does not include any user warning about deletion risk, reversibility, or need for confirmation. For markdown files, omission of warnings about behaviors that could affect user data or system integrity should be flagged.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares access to environment credentials and uses networked API access, but it does not specify any tool/permission scope. In an agent setting, missing explicit scope increases the chance the skill can be invoked with broader capabilities than users expect, especially because it uses a direct API key and remote CRUD operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The setup instructions tell users to place an API key directly into a local environment file without emphasizing its sensitivity or handling requirements. This can lead to insecure storage, accidental commits, or overbroad distribution of a credential that enables direct CRM access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises delete operations without any warning, confirmation guidance, or mention of irreversible consequences. In an agent-driven workflow, this raises the risk of accidental or prompt-induced destructive actions against production CRM records.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module documentation emphasizes direct querying and fresh reads, but the code also performs create, update, delete, and note creation actions. In security-sensitive agent workflows, inaccurate documentation can mislead operators into granting or invoking mutating behavior they did not expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description claims CRUD for companies, people, and notes, but the implementation also exposes broader Attio access such as deals, tasks, pipelines, object enumeration, and generic object queries. This mismatch increases the risk that users or calling agents invoke capabilities they did not knowingly authorize, expanding data exposure and modification scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · attio_client.py (reported line 43)May include surrounding context.

python

if not API_KEY:
    print(json.dumps({"error": "No API key found. Set ATTIO_API_KEY env var or create .env file"}))
    sys.exit(1)
BASE_URL = "https://api.attio.com/v2"

def make_request(endpoint: str, method: str = "GET", data: dict = None, timeout: int = 60) -> dict:
    """Make request to Attio API with proper headers and timeout."""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The delete operation executes immediately when given an object type and record ID, with no confirmation, dry-run option, or safeguard. In an agent-operated environment, this raises the likelihood of accidental or prompt-induced destructive actions against production CRM data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI supports arbitrary endpoint access via --raw and also falls back to generic object querying for unrecognized endpoints, effectively turning the skill into a broad Attio API proxy. In an agent context, this can bypass the narrower business purpose described in metadata and enable unexpected reads or writes across the tenant.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script reads an API credential from the ATTIO_API_KEY environment variable and falls back to a local .env file, but there is no user-facing notice that sensitive credentials are being accessed. For code files, access to sensitive environment variables or credentials should have some visible disclosure unless already clearly warned elsewhere.

Content

No source excerpt is available for this finding.