Security audit

Dex CRM

Security checks across malware telemetry and agentic risk

Overview

This Dex CRM skill uses the expected Dex API, but it includes broad delete and bulk-archive abilities that are not clearly scoped in the main skill description.

Review before installing. Use only a Dex API key you are comfortable granting read/write CRM access, run the cleanup script only with --dry-run until you have reviewed the exact contacts, and avoid delete or archive operations unless the target records are explicit and confirmed.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill requires network access and a secret API key but does not declare those permissions, creating a transparency and governance gap. Users or a skill platform may underestimate the data-access and exfiltration surface, especially because the skill can read and mutate CRM records over the network.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The README advertises capabilities to create and archive contacts that are outside the stated skill scope provided in the metadata. Scope drift is dangerous in an agent skill because users and reviewers may authorize a contact lookup/note-taking tool while the implementation or documented behavior also permits destructive or higher-impact state changes to CRM data.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The documented cleanup script enables bulk archival of contacts based on heuristic patterns, which is materially broader and more destructive than the core CRM lookup/note/reminder scope. In an agent ecosystem, undocumented bulk-modification features increase the risk of unintended mass changes, especially when users may not expect a skill install to include operational scripts that can alter large portions of their Dex data.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The manifest describes browsing contacts, notes, reminders, and contact lookup, but the documented behavior also includes creating, updating, and deleting contacts. This scope mismatch is dangerous because users may invoke what seems like a read-oriented CRM skill without realizing it also supports destructive record modification.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The script performs destructive archival of contacts, which is broader than the manifest's described contact lookup, notes, and reminders behavior. In an agent-skill context, undeclared destructive capabilities increase the risk of surprising or unauthorized state changes, especially if invoked automatically or by a user who expects read/light-write CRM actions only.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The module docstring advertises a cleanup/archival function that is not represented in the stated skill description. Hidden or undocumented capabilities are risky in agent ecosystems because they can bypass user expectations and review assumptions about what actions the skill can take.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README describes archival behavior without a clear warning that running the script will modify user data in Dex. This is dangerous because users may treat README examples as safe operational guidance and run commands without appreciating that contacts may be archived permanently or semi-permanently based on imperfect junk-detection rules.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script archives contacts in bulk without a confirmation prompt or other strong safeguard, so a mistaken invocation can silently alter large portions of a user's CRM data. Although archiving is reversible in some systems, the immediate operational impact can still be significant by hiding contacts and disrupting workflows.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.