T09 · Insecure Skill Coding Practices
Warning
- Location
crm.py:54- Finding
Plaintext CRM records stored without enforced restrictive file permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Gracie Crm
Security checks for vulnerabilities and agentic risk
Overview
This is a functional local CRM skill, but it ships live-looking contact data and can import a fixed private lead file from the user's home directory without clear scoping or preview.
Install only if you intend to use this personal Gracie CRM workflow. Review or remove the bundled crm.json records first, understand that the import command may copy leads from the fixed ~/StudioBrain/30_INTERNAL/WLC-Services/LEADS/MASTER_LEAD_LIST.md path, and keep the CRM data file in a private location with restrictive permissions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger conditions are broad enough to match generic CRM and lead-management requests without clear boundaries, which can cause the agent to invoke this skill in situations the user did not specifically intend. That increases the risk of inappropriate access, modification, or disclosure of sales lead data, especially if other skills or workflows overlap in scope.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script is hard-coded to read from a user-home path outside the skill directory and import its contents into the local CRM store. That creates an unexpected cross-boundary data access path that can expose unrelated personal or internal lead data and silently duplicate sensitive information into another file when the import command is run.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The import feature reads a hard-coded personal/internal markdown file and ingests its contents without any warning, confirmation, or scope limitation. In this skill context, that is more dangerous because a sales CRM will store names and phone numbers, so the behavior can quietly copy sensitive business contact data from an unrelated location into a new datastore.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code writes CRM lead data to crm.json, which is a user-data-affecting file write. Although the action is part of the tool's purpose, there is no docstring, comment, or command-level warning disclosing that lead additions, notes, calls, and imports persist data to disk.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The _parse_master_leads docstring says a valid lead row may contain either a bold business name or a plausible non-header name. However, the code immediately below rejects any row where no bold text is found, so the documented parsing behavior contradicts the actual implementation.
- Content
Static analysis
No suspicious patterns detected.