T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:6- Finding
Unnecessary Exposure of a Privileged HubSpot Access Token
- Content
View full analysis
- Remediation
View remediation
Security audit
Lead Scoring
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly lead-scoring related, but it asks for a live HubSpot token and includes operational CRM/data-processing behavior despite presenting itself as instruction-only.
Review this skill before installing. Use it only with a test CRM or least-privilege token, and do not grant a production HubSpot token unless you intend the agent environment to have access to CRM configuration and contact data. Expect the script to create scored contact CSV files, and back up CRM exports before running it.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/score-calculator.py:660- Finding
Unsafe Output Path Derivation Can Overwrite or Truncate CRM Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code is related to lead scoring, so the domain overlaps with the description. However, the declared purpose explicitly says this is an instruction-only skill with frameworks and setup guides for HubSpot/CRMs, while the supplied code is an operational scoring engine that processes actual CSV data, computes scores, classifies leads, and saves results. That is a materially different behavior and introduces undeclared file-processing capabilities. It does not implement HubSpot setup guidance or lifecycle-stage configuration; instead it acts as a standalone analytics/scoring utility. Therefore this is a description-behavior mismatch.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes the skill as instruction-only, yet it declares required live CRM credentials, which implies the skill may operate against real tenant data or configuration. This mismatch can mislead users and orchestrators into granting sensitive tokens to content they believe is passive guidance, increasing the risk of unintended data access or configuration changes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The credential notes explicitly mention API access to configure scoring properties and workflows, directly contradicting the instruction-only positioning. That inconsistency is dangerous because it obscures that the skill can make persistent CRM changes, which could affect production sales and marketing operations if invoked with real credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description references CRM access tokens and API-based configuration but does not disclose that handling CRM records may expose customer and prospect data or alter lead-scoring logic and lifecycle automation. In this context, the omission matters because CRM integrations often touch sensitive business data and production workflows, so users need clear notice before granting access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The guide instructs users to collect and act on detailed behavioral data such as page views, form submissions, email opens, clicks, and replies to score and route leads, but it provides no guidance on consent, lawful basis, notice, retention, or jurisdictional privacy requirements. In CRM/marketing automation context, this can lead to noncompliant profiling and tracking practices under regulations like GDPR, ePrivacy, and similar laws, especially when automated lifecycle changes and nurturing are triggered from that data.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 3. **Workflow Actions**: - Set Lifecycle stage to "Marketing Qualified Lead" - Create task for marketing team - Send internal notification - Add to MQL nurturing sequence
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 3. **Workflow Actions**: - Set Lifecycle stage to "Marketing Qualified Lead" - Create task for marketing team - Send internal notification - Add to MQL nurturing sequence
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs collection and scoring of behavioral, demographic, and inferred intent data such as page visits, email engagement, phone number, budget range, and third-party intent signals, but provides no privacy notice, consent guidance, lawful-basis checks, retention limits, or regional compliance considerations. In a lead-scoring skill for CRM automation, this omission is risky because it operationalizes profiling and potentially automated decision-making on personal data, which can create privacy, compliance, and trust harms if deployed as written.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code writes a full scored contacts CSV and a separate top-20 contacts CSV derived from CRM exports, which commonly contain personal and business-sensitive data. Although output paths are logged, there is no explicit warning or confirmation to the user that additional files containing processed lead data will be created.
- Content