T09 · Insecure Skill Coding Practices
Warning
- Location
crm_cli.py:21- Finding
CRM Data Files Are Created Without Enforced Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
CRM in a Box (Hybrid Labs)
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward local CRM skill, but it overstates tamper-evidence and gives weak privacy guidance for sensitive customer data.
Use only in a private, access-controlled directory or repository, restrict file permissions, and treat all CRM files as plaintext sensitive records. Do not rely on the advertised hash-chain or tamper-evident audit trail unless the implementation is fixed, and review agent-made CRM changes before using the data for business decisions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:5- Finding
Advertised Cryptographic Hash-Chain Integrity Is Not Implemented
- Content
View full analysis
Hash-Chained
Every entry is cryptographically linked. Full audit trail. Tamper-evident by design.
``` However, records are appended as ordinary JSON without a previous-record hash, record hash, digital signature, trusted anchor, or verification routine: ```python contact = { "id": contact_id, "name": name, "email": email, "company": company, "phone": phone, "stage": "new", "labels": labels or [], "notes": notes or "", "created_at": datetime.utcnow().isoformat() + "Z" } with open(contacts_file, 'a') as f: f.write(json.dumps(contact) + "\n") ``` ```python pipeline_entry = { "id": f"p{datetime.now().strftime('%Y%m%d%H%M%S')}", "contact_id": contact_id, "stage": stage, "deal": deal, "value": value, "updated_at": datetime.utcnow().isoformat() + "Z" } with open(pipeline_file, 'a') as f: f.write(json.dumps(pipeline_entry) + "\n") ``` ```python interaction = { "id": f"i{datetime.now().strftime('%Y%m%d%H%M%S')}", "contact_i ...[truncated 2276 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README encourages storing contacts, pipeline data, and full interaction history in plain repo-managed files but provides no warning about handling sensitive customer information, access controls, or regulatory obligations. In this skill's context, that omission is meaningful because CRM records commonly contain personal data, communications, and business-sensitive notes that could be inadvertently committed, over-shared, or retained indefinitely.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to read and write local CRM files but does not declare any explicit tool scope or path restrictions. In an agent environment, missing scope boundaries can lead to broader-than-necessary filesystem access, increasing the chance of unintended reads, overwrites, or misuse of local data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is explicitly designed to store contacts, emails, phone numbers, notes, interactions, and deal data in plaintext local files, but it provides no warning or safeguards for handling sensitive personal or business information. This creates a realistic risk of privacy exposure, accidental leakage, insecure sharing, or noncompliance with data-protection requirements if the files are stored, copied, or searched insecurely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This HTML file is a code file, so SQP-2 applies to user-affecting behaviors described in visible content. The statement advertises agent-driven reads, writes, and actions on CRM data, but the page provides no warning or disclosure about possible data changes, privacy impact, or need for user oversight.
- Content
Static analysis
No suspicious patterns detected.