ClawHub

Attio CRM CLI

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Attio CRM helper, but it handles live CRM credentials and metadata, so users should install and run it carefully.

Before installing, inspect or pin the external attio-cli repository, use a least-privileged Attio API key, keep the key out of shared or committed dotfiles, and treat generated workspace schema files as sensitive business metadata. Only run create-record or add-entry examples when you intend to change the target CRM workspace.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly instructs users to generate a workspace schema file that may contain detailed CRM metadata such as object names, attributes, lists, and field options, but it does not warn that this output can be sensitive business data. In an agent context, such a file could be retained, shared in prompts, committed to source control, or exposed to other tools, increasing the risk of unintended data disclosure.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The instructions recommend placing a live API key in persistent shell startup files and a Claude-specific environment file without discussing credential exposure, filesystem permissions, or the risk of accidental reuse by unrelated processes. Persisting secrets this way can broaden exposure if the host is shared, backed up insecurely, or if dotfiles are committed or inspected by other tools.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal