ClawHub
Back to skill

Security audit

Attio CRM CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Attio CRM helper, but its unpinned global CLI installation and under-warned live CRM write examples deserve review before use.

Review the upstream CLI before installing, pin it to a known commit or release if possible, and prefer a least-privileged Attio API key. Treat generated workspace.schema.md as sensitive CRM metadata, keep it out of version control, and run the create-record or add-entry examples only in a sandbox or after confirming they should modify the live workspace.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:7
Finding

Unpinned Third-Party CLI Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7–10
Vulnerability Type: Unpinned third-party dependency and unsafe installation procedure
Risk Level: Medium

Vulnerable Code

bash
git clone https://github.com/FroeMic/attio-cli
cd attio-cli
npm install
npm link

Technical Analysis

The installation instructions clone the current default branch of a third-party GitHub repository without pinning a reviewed commit, immutable release tag, checksum, or signature. The subsequent npm install may install mutable transitive dependencies and execute package lifecycle scripts. npm link then exposes the resulting CLI globally in the user's npm environment.

Consequently, the code executed by users can differ from the version assessed during this audit. A compromise of the upstream repository, its maintainer account, or an npm dependency could introduce arbitrary code. This is a supply-chain weakness rather than evidence that the currently referenced project is malicious.

Attack Path

  1. An attacker compromises the referenced repository, a maintainer account, or one of its npm dependencies.
  2. The attacker adds malicious code or an npm lifecycle script to the mutable upstream source.
  3. A user follows the documented commands and clones the compromised default branch.
  4. npm install installs the altered dependency graph and may execute attacker-controlled lifecycle scripts.
  5. The payload runs with the user's privileges and may inspect local files, environment variables, or authentication material such as ATTIO_API_KEY.
  6. npm link can make the compromised executable available as the globally resolved attio command, extending exposure to later invocations.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user performing the installation. The accessible scope could include local files readable by that user, environme ...[truncated 319 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed, immutable commit hash or signed release rather than cloning the mutable default branch.
  2. Publish and verify a cryptographic checksum or signature for the approved source archive.
  3. Require a committed lockfile and use npm ci to reproduce the reviewed dependency graph.
  4. Audit npm lifecycle scripts and use npm ci --ignore-scripts where lifecycle execution is unnecessary.
  5. Avoid npm link for routine installation. Prefer a versioned package or a project-local executable with a constrained execution path.
  6. Document the exact approved upstream version and establish an update-review process.
  7. Use a least-privileged, revocable Attio API key and rotate it if installation occurs from an unverified source.
  8. Store credential files with restrictive permissions and exclude generated workspace schema files from version control because they may reveal sensitive CRM structure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to generate and save a workspace schema file documenting CRM objects, attributes, lists, and field options to local disk without any warning about sensitivity. In a CRM context, this metadata can reveal internal business structure, workflow names, custom fields, and other reconnaissance material that may be sensitive even if record contents are not included.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
## API Reference

- **Base URL:** `https://api.attio.com/v2`
- **Auth:** `Authorization: Bearer $ATTIO_API_KEY`
- **Rate Limits:** 100 requests per 10 seconds per workspace

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
## API Reference

- **Base URL:** `https://api.attio.com/v2`
- **Auth:** `Authorization: Bearer $ATTIO_API_KEY`
- **Rate Limits:** 100 requests per 10 seconds per workspace

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
## API Reference

- **Base URL:** `https://api.attio.com/v2`
- **Auth:** `Authorization: Bearer $ATTIO_API_KEY`
- **Rate Limits:** 100 requests per 10 seconds per workspace

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
## API Reference

- **Base URL:** `https://api.attio.com/v2`
- **Auth:** `Authorization: Bearer $ATTIO_API_KEY`
- **Rate Limits:** 100 requests per 10 seconds per workspace

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Search for a person:

bash
curl -X POST https://api.attio.com/v2/objects/people/records/query \
  -H "Authorization: Bearer $ATTIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"filter": {"email_addresses": {"contains": "john@example.com"}}}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The examples include live write operations against the Attio API, specifically record creation and list entry creation, but do not clearly warn that these commands modify production CRM data. Users may run them as examples and unintentionally create or alter real business records and workflow state.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

-d '{"data": {"values": {"name": [{"value": "Record Name"}]}}}'

text

Add entry to a list:
```bash
curl -X POST https://api.attio.com/v2/lists/<list-slug>/entries \
  -H "Authorization: Bearer $ATTIO_API_KEY" \

Static analysis

No suspicious patterns detected.