Security audit

Ahc Automator

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-built for AHC automation, but it can read local email, store API tokens insecurely, and automatically change business systems with weak safeguards.

Review before installing. Use only with approved AHC mailboxes and least-privilege ClickUp/Pipedrive tokens, avoid custom config files from untrusted sources, remove the hard-coded sample email behavior, and do not store API tokens in shell startup files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.py:173
Finding: API tokens are persisted in plaintext and unsafely interpolated into shell startup files
Content: View full analysis
> ~/.zshrc echo 'export PIPEDRIVE_API_TOKEN="seu_token_pipedrive"' >> ~/.zshrc source ~/.zshrc ``` ### Technical Analysis The setup process permanently stores ClickUp and Pipedrive API tokens in `.zshrc` or `.bash_profile`. These files are ordinary plaintext files and may be exposed through backups, support archives, shell configuration synchronization, local malware, accidental repository commits, or access by another process running as the same user. The entered value is also inserted directly into shell syntax without escaping. A value containing a double quote, newline, command substitution, or additional shell commands can break out of the intended `export` statement. The injected content executes whenever the user starts a shell or explicitly sources the profile. Fo ...[truncated 1586 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ahc_utils.py:57
Finding: Configuration-controlled API base URLs can redirect credentials and business data to arbitrary servers
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ahc_utils.py:139
Finding: Pipedrive API token is exposed in request query strings
Content: View full analysis
`. Query strings are commonly captured by reverse proxies, web server access logs, monitoring platforms, network debugging tools, exception reporting systems, and security appliances. HTTPS protects the URL in transit from passive network observers, but it does not prevent the full request target from being recorded at either endpoint or by trusted infrastructure. The risk is amplified by the configurable base URL and by callers that include returned error details in logs. ### Attack Path 1. A legitimate workflow sends a Pipedrive request. 2. The full request target contains the API token in its query string. 3. A proxy, server, monitoring agent, debugging tool, or attacker-controlled configured endpoint records the URL. 4. An individual with access to those logs extracts the token. 5. The token is replayed directly against Pipedr ...[truncated 317 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ahc_utils.py:243
Finding: Configuration-controlled email account names are injected into AppleScript source
Content: View full analysis
(current date) - (5 * minutes) then set end of recentEmails to {{subject:(subject of theMessage), sender:(sender of theMessage as string), content:(content of theMessage), date_received:messageDate}} end if end repeat end repeat end if end repeat return recentEmails end tell ''' result = subprocess.run( ['osascript', '-e', script], capture_output=True, text=True ) ``` ### Technical Analysis An account name read from configuration is directly inserted into AppleScript source between double quotes. No AppleScript escaping or parameter binding is used. A malicious account string can terminate the string literal and append arbitrary AppleScript statements. AppleScript supports `do shell script`, which permits local command execution. Although `subprocess.run()` correctly avoids `shell=True`, that protection is ineffective because the generated AppleScript itself is the injection target. Exploitation requires control over the configuration or another path that supplies the `accounts` collection. The scripts' `--config` option provides a practical route to using attacker-crafted account values. ### Attack Path 1. An attacke ...[truncated 950 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ahc_utils.py:274
Finding: Email parser always returns a hard-coded sample message, causing repeated unauthorized ClickUp writes
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (60)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior does not cleanly match the declared purpose: it includes WhatsApp notification handling, logging, and references to automation components that are not fully represented in the manifest. Description-behavior mismatch is dangerous because users and security controls may approve the skill for one purpose while it performs additional communication and operational actions, enabling covert data propagation or unexpected side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The function accesses Apple Mail content, including sender, subject, and message body, without any visible consent, prompt, or disclosure mechanism. Silent collection of recent email content is highly sensitive and particularly risky because this skill is for workflow automation, where users may not expect host mailbox scraping.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents capabilities that imply shell execution, filesystem access, environment-variable use, and network/API operations, but it does not declare any explicit tool scope or permission boundaries. In an automation skill that processes email and updates third-party systems, missing scope declarations increases the chance of over-privileged execution, unintended data access, and abuse of local/system resources.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrases include broad terms like client onboarding and project completion, which are common across many business contexts and not uniquely bound to Alan Harper Composites. Overbroad activation can cause the skill to run in unintended contexts, increasing the risk of processing the wrong user's data, initiating external actions unexpectedly, or exposing internal business automations where they do not belong.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill describes automatic monitoring and parsing of email content from named accounts without an explicit privacy warning or consent boundary. Because emails commonly contain personal, commercial, and operationally sensitive information, silent or underspecified monitoring creates privacy, compliance, and data-handling risks, especially when data is forwarded into ClickUp, Pipedrive, logs, and notifications.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill states that email processing leverages Apple Mail via osascript integration, which introduces local script-execution capability. Even if intended for benign automation, osascript materially expands the attack surface because email-derived content or workflow parameters could be routed into system-level scripting paths, enabling local command execution or unauthorized access to desktop mail data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The configuration monitors a personal Gmail account alongside a corporate address for AHC-specific business automation, which expands processing beyond clearly scoped business systems. This creates a real risk of unauthorized collection of personal communications and accidental triggering of business actions from non-corporate email, especially because downstream automations can create tasks and deals automatically.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger keywords are broad and common terms such as 'clickup', 'pipedrive', 'add deal', and 'nova tarefa', while workflows are configured to auto-create tasks and deals. This makes unintended activation plausible from ordinary email content, forwarded messages, signatures, or casual discussion, leading to unauthorized or erroneous changes in external business systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README describes automated monitoring and processing of email accounts, including parsing content and triggering downstream actions, but does not warn about privacy, consent, retention, or handling of sensitive business data. Because this skill processes potentially confidential communications and customer information, missing privacy guidance increases the risk of unauthorized or noncompliant deployment.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README presents WhatsApp as an implemented integration in the overview, but later states that real WhatsApp integration is not implemented. This inconsistency can mislead operators into assuming messages are actually being delivered, causing missed alerts, incorrect workflow expectations, and unsafe business reliance on a nonexistent notification channel.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The workflow diagram claims real-time WhatsApp notifications occur automatically, while later troubleshooting states notifications are only logged and the real integration is pending. In an automation skill handling project and client workflows, this can create operational blind spots if staff depend on urgent notifications that are never sent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The onboarding workflow documentation explains how to create clients, projects, deals, and related records in external systems, but does not clearly warn that these are real side effects. Users may treat the script like a dry-run helper and unintentionally create persistent CRM/project records, leading to data pollution, accidental customer creation, or business process errors.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The project completion workflow can trigger invoicing, generate reports, and notify stakeholders, yet the documentation does not emphasize that these may be irreversible or business-critical actions. In a production operations context, silent execution of completion steps can cause premature billing, inaccurate status changes, or unintended customer/stakeholder communication.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 372)May include surrounding context.
Solução:

bash
# Verificar cron jobs crontab -l # Verificar se IDs estão presentes: # 7c4c353d-55dd-4de9-b315-344f68e147e1 (Ian ClickUp)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · docs/README.md (reported line 350)May include surrounding context.
Solução:

bash
# Verificar cron jobs crontab -l # Verificar se IDs estão presentes: # 7c4c353d-55dd-4de9-b315-344f68e147e1 (Ian ClickUp)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · docs/README.md (reported line 452)May include surrounding context.
Solução:

bash
# Verificar cron jobs crontab -l # Verificar se IDs estão presentes: # 7c4c353d-55dd-4de9-b315-344f68e147e1 (Ian ClickUp)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code accesses credentials from environment variables and configuration, then transmits task and CRM data to external ClickUp and Pipedrive APIs. Although the functions have internal docstrings, there is no user-facing warning, confirmation, or visible disclosure that credentials and potentially user data will be sent to third-party services.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · configs/ahc_config.json (reported line 11)May include surrounding context.
json
self.config = config self.api_token = self.config.get_env_or_config('CLICKUP_API_TOKEN', 'clickup', 'api_token') self.team_id = self.config.get('clickup', 'team_id') self.base_url = self.config.get('clickup', 'api_url', default='https://api.clickup.com/api/v2') if not self.api_token: raise Exception("ClickUp API token não encontrado")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/ahc_utils.py (reported line 59)May include surrounding context.
python
self.config = config self.api_token = self.config.get_env_or_config('CLICKUP_API_TOKEN', 'clickup', 'api_token') self.team_id = self.config.get('clickup', 'team_id') self.base_url = self.config.get('clickup', 'api_url', default='https://api.clickup.com/api/v2') if not self.api_token: raise Exception("ClickUp API token não encontrado")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · configs/ahc_config.json (reported line 17)May include surrounding context.
json
def __init__(self, config): self.config = config self.api_token = self.config.get_env_or_config('PIPEDRIVE_API_TOKEN', 'pipedrive', 'api_token') self.base_url = self.config.get('pipedrive', 'api_url', default='https://api.pipedrive.com/v1') if not self.api_token: raise Exception("Pipedrive API token não encontrado")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/ahc_utils.py (reported line 126)May include surrounding context.
python
def __init__(self, config): self.config = config self.api_token = self.config.get_env_or_config('PIPEDRIVE_API_TOKEN', 'pipedrive', 'api_token') self.base_url = self.config.get('pipedrive', 'api_url', default='https://api.pipedrive.com/v1') if not self.api_token: raise Exception("Pipedrive API token não encontrado")

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The docstring says the method retrieves recent emails from monitored accounts, yet the implementation ends by returning a fixed example message regardless of account contents or the since_time argument. This is an active contradiction between documented intent and real behavior, not merely an incomplete implementation detail.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This utility reads local Apple Mail via AppleScript, which is a powerful host-execution capability and exposes message subjects, senders, and content from the user's machine. In an automation skill, this is dangerous because it crosses from ordinary SaaS workflow integration into desktop data access without strong scoping or transparency.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 91% confidence
Finding: The code invokes AppleScript through osascript to read Apple Mail content from the host system. Even though the subprocess arguments are passed as a list rather than through a shell, this still grants the skill host-level access to local mail data and expands the attack surface to sensitive desktop resources.
Content: Scanner excerpt · scripts/ahc_utils.py (reported line 263)May include surrounding context.
python
end tell ''' result = subprocess.run(['osascript', '-e', script], capture_output=True, text=True) if result.returncode == 0:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script performs real external writes to Pipedrive and ClickUp and sends WhatsApp notifications as part of onboarding, but there is no explicit confirmation, dry-run default, or safeguard before side effects occur. In an agent skill context, this increases the risk of accidental client creation, CRM deal creation, project spam, or unintended notifications triggered from misunderstood prompts or bad inputs.
Content: No source excerpt is available for this finding.