ClawHub
Back to skill

Security audit

CordysCRM

Security checks across malware telemetry and agentic risk

Overview

This CRM skill appears legitimate, but it needs Review because it can use CRM credentials for broad raw API calls and high-impact approval, financial, and account changes without enough containment.

Install only if you trust the publisher and the Cordys CRM credentials you provide are least-privilege. Avoid enabling CORDYS_ALLOW_UNTRUSTED, avoid raw API calls unless you understand the target endpoint, and review approval-flow, financial write, and user-role.md persistence behavior before using it with production data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)

Tainted flow: 'req' from os.environ.get (line 194, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers=headers,
            method=method.upper()
        )
        with request.urlopen(req) as response:
            charset = response.headers.get_content_charset() or "utf-8"
            return response.read().decode(charset, errors="replace")
    except HTTPError as e:
Confidence
96% confidence
Finding
with request.urlopen(req) as response:

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill requires secrets, external network access, and appears to construct CLI/API operations, yet it does not declare explicit permissions for environment, network, and shell capabilities. This weakens policy enforcement and review because powerful capabilities are available implicitly, making accidental secret exposure or unsafe command execution harder to govern.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill description frames the capability as a CRM assistant, but the documented behavior extends to approvals, workflow administration, record creation and updates, lead conversion, organizational queries, and a raw API mode that may reach arbitrary relative paths and possibly untrusted domains with credentials. This mismatch can mislead users and reviewers about the actual authority of the skill, increasing the chance of unintended high-impact actions and credential-bearing requests beyond the expected CRM scope.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The skill advertises business CRM workflows, but also exposes a generic raw authenticated API primitive that can reach endpoints outside the declared feature set. This expands the authority of the skill beyond user expectations and can be abused to access sensitive functions or data not intended by the manifest-scoped business purpose.

Description-Behavior Mismatch

Medium
Confidence
82% confidence
Finding
The code includes approval-flow administration, enable/disable actions, updates, and webhook testing even though the skill is presented as CRM/L2C workflow support. These administrative capabilities increase blast radius and may permit workflow manipulation or integration abuse beyond the expected sales-operations context.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code explicitly permits sending authenticated requests to untrusted domains when CORDYS_ALLOW_UNTRUSTED=1 is set. Because the request always carries the CRM access and secret keys, this creates a straightforward credential exfiltration path and makes the domain check ineffective as a security control.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill exposes a generic `raw` command that lets callers send arbitrary HTTP methods, paths, and extra curl arguments while automatically attaching the CRM access and secret keys. Although there is a domain check for absolute URLs, relative paths still permit unrestricted access to any endpoint on the configured CRM domain, which exceeds the declared workflow scope and materially increases the chance of sensitive data access, unauthorized state changes, or credential leakage if `CORDYS_ALLOW_UNTRUSTED=1` is enabled.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases are very broad, covering common CRM nouns and business terms that are likely to appear in ordinary conversation. This can cause the skill to activate unintentionally in contexts where the user did not intend to invoke a credentialed CRM workflow, leading to unnecessary data access or action-oriented prompting.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The priority routing rules use broad natural-language triggers such as vague work prompts and fuzzy search phrases without sufficient disambiguation or confirmation before taking action. In a CRM skill that can route into write, linkage, and cross-module data access flows, this can cause the assistant to select the wrong execution path, exposing unrelated customer data or initiating unintended workflows.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The intent mapping table contains many ambiguous phrases like '看看XX公司', '批一下', and '审批到哪了' with no role, scope, or exclusion checks described at the mapping layer. In this CRM context, those phrases can be exploited to steer the agent into higher-privilege profiles or broader organizational queries than the user actually intended, increasing the risk of data overexposure and unauthorized workflow actions.

Vague Triggers

Medium
Confidence
93% confidence
Finding
Automatically calling `approval todo count` at conversation start is an overbroad, implicit action that can query potentially sensitive workflow metadata without a user request in that turn. In a CRM/approval context, this increases the chance of unintended data exposure, side-channel disclosure of role status or workload, and surprise backend access on every session.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The refresh triggers are defined as simple natural-language phrases (e.g., “刷新身份”, “换账号”) without confirmation or tighter intent validation. In a conversational system, ambiguous phrasing can cause unintended reinitialization, overwriting local identity state and invoking privileged identity lookups unexpectedly.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The workflow explicitly fetches personal account data from an API and writes it to user-role.md, but does not require clear user notice or consent for local persistence. This creates privacy and compliance risk because identifiable data is stored as a reusable artifact without explicit disclosure, retention boundaries, or access protections.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger keywords are broad and overlap with common CRM/business terms such as 商务、法务、合规 and 合同管理, which increases the chance that this role profile is selected in unrelated or multi-role conversations. In this skill, misrouting is security-relevant because the profile enables contract, order, and business-title create/update workflows and cross-role notifications, so an incorrect match could expose privileged operations or sensitive contract context to the wrong workflow.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The finance role is triggered by broad keywords such as “财务” and “会计”, which can easily appear in ordinary discussion without the user intending to invoke a privileged finance workflow. In this skill, a role mismatch is more dangerous because the finance profile exposes organization-wide contract, receivable, invoice, and approval data, increasing the chance of unintended access paths or unsafe action suggestions.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The profile explicitly maps to create/update operations for payment plans, payment records, and invoices, but it does not warn users that these commands mutate financial system records and may have accounting, audit, or cash-flow consequences. In a finance context, silent or ambiguous write-capable guidance is especially risky because users may trigger irreversible or high-impact changes without verification, approval awareness, or confirmation.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger keywords include very broad managerial terms such as ‘经理’, ‘总监’, ‘主管’, ‘负责人’, and ‘leader’, which commonly appear in normal conversation and can cause unintended activation of this skill. In a CRM skill with access to department-level data and approval workflows, misrouting a user request could expose team information or invoke inappropriate workflow guidance.

Vague Triggers

Medium
Confidence
83% confidence
Finding
Several invocation phrases and workflow cues like ‘团队今天’, ‘批一下’, ‘团队这周’, and ‘有什么问题’ are underspecified and lack clear activation boundaries or exclusion conditions. Because these are short, natural expressions, they can be triggered in ordinary chat and lead the agent toward CRM queries, approval inspection, or risk analysis without sufficiently verifying user intent or scope.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger keywords are broad enough that common workplace language like 销售、运营、顾问 or references to leads/customers can invoke the CRM skill unintentionally. In this skill, accidental activation is meaningful because the profile contains concrete CRM query/write guidance, cross-module workflow behavior, and role-driven data access patterns that could cause unintended data retrieval or action suggestions in normal conversation.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This document teaches state-changing CRM and approval operations such as add, update, approve, reject, revoke, and delete against live business resources, but it provides no explicit warning, confirmation requirement, or sandbox-only guidance. In an agent skill context, that omission is dangerous because an LLM may translate casual user requests directly into destructive or compliance-sensitive actions on production records.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation explicitly exposes a raw arbitrary-request mechanism (`cordys raw {METHOD} {PATH}`) that allows callers to compose unrestricted API requests, yet it lacks any warning that malformed or state-changing calls can modify CRM data or bypass safer CLI abstractions. In an LLM-driven skill, this materially increases the chance of prompt-driven misuse, accidental destructive actions, or access to sensitive administrative endpoints beyond the intended workflow.

Ssd 3

Medium
Confidence
95% confidence
Finding
These instructions tell the system to collect user identity data from API responses and persist it locally as part of normal operation. In the context of an agent skill, this is more dangerous because it normalizes storage of personal data in a local file that may be reused across sessions, exposed to other components, or retained longer than necessary.

Ssd 3

Medium
Confidence
90% confidence
Finding
The skill instructs the AI to inspect historical dialogue and infer role from prior activity patterns, which expands processing of user behavioral data beyond the immediate request. This is risky because it can create hidden profiling, inaccurate role assignment, and unauthorized use of past conversation content for access-shaping decisions.

Ssd 3

Medium
Confidence
96% confidence
Finding
The example schema stores directly identifying account information such as user ID, name, position, and email in a local reusable file. This increases the blast radius of any local file disclosure, accidental commit, plugin access, or cross-session leakage, especially because the file is intended to drive future behavior automatically.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.