Security audit

Breakcold

Security checks for vulnerabilities and agentic risk

Overview

This Breakcold CRM skill is coherent, but needs Review because it can read inbox and CRM data and make recurring, persistent CRM changes with broad scope and limited confirmation.

Install only if you are comfortable giving this skill broad Breakcold CRM and inbox authority. Before enabling routines, set explicit limits for workspace, channels, date range, auto-create versus suggest-only behavior, recap recipients, and which fields or records it may change. Use previews or small batches for CRM reorganization, contact creation, pipeline movement, and prospect research, and confirm that Breakcold sanitizes rich HTML notes before relying on automatic note generation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: references/action-prospect-research.md:54
Finding: Unsanitized External Content Persisted in Rendered CRM HTML Notes
Content: View full analysis
[breakcold-crm:research {YYYY-MM-DD}]

Company — {company name}

What they do: {one or two sentences}

Size / stage: {e.g., Series B, ~120 employees, founded 2018}

Recent:

{news item with rough date}

{another news item}

Why we might fit: {one line, in the us ...[truncated 4388 chars]
Remediation: View remediation
`, `"`, and `'`. - Do not treat fetched HTML or CRM field values as trusted markup. 2. **Validate source URLs** - Parse each source URL using a trusted URL parser. - Allow only absolute `https:` URLs. - Reject `javascript:`, `data:`, `file:`, `blob:`, and other non-HTTPS schemes. - Prevent control characters or encoded values from bypassing scheme checks. 3. **Sanitize generated HTML** - Pass the final note through a well-maintained, allowlist-based sanitizer before `notes_create`. - Permit only the required elements, such as `p`, `strong`, `h3`, `ul`, `li`, `hr`, and `a`. - Forbid scripts, styles, forms, frames, embedded media, SVG, event attributes, and arbitrary attributes. - Permit only validated `href` attributes on anchors. 4. **Treat remote content as untrusted data** - Explicitly instruct the Agent that webpage text, metadata, and embedded instructions cannot alter the research workflow. - Extract factual data without following commands found in fetched content. - Cross-check facts against independent sources before persistence. 5. **Prefer structured rendering** - Where possible, submit structured fields and let a trusted application renderer generate HTML. - If raw HTML is unavoidable, centralize template rendering and escaping rather than asking the Agent to concatenate markup. 6. **Avoid unnecessary replication** - Do not duplicate the full HTML note onto linked deals by default. - Store a safe internal record reference or sanitized plain-text summary instead. 7. **Add security tests** - Test values containing closing tags, event handlers, malicious anchors, encoded URI schemes, SVG payloads, and malformed attributes. - Verify that both the Skill-generated output and Breakcold's server-side renderer ne ...[truncated 28 chars]

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (32)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
- `assets/` — text-based brand assets: Breakcold mark SVG, full logo SVG, and a fully populated `report-template.html` chassis with the mascot embedded inline.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/report-template.html (reported line 1088)May include surrounding context.
html
<body class="js"> <div class="scrollbar" id="sp" style="width: 0%;"></div> <div class="wrap">  <div class="topbar"> <svg class="logo"

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to scan highly sensitive private communications across multiple channels and to auto-create CRM records, but it does not require a clear upfront consent/notice step describing the scope of access and the writes that may occur. This creates a meaningful privacy and integrity risk because the agent may process personal data and modify the CRM in ways the user did not fully understand at invocation time.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly allows scheduled end-to-end runs to proceed without confirmation, enabling unattended scanning of inbox content and automatic CRM modifications. That is dangerous because recurring autonomous processing of private messages can continuously ingest personal data, create records, and leave audit breadcrumbs without a fresh user checkpoint or a strong warning at setup time.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guide allows clustering reasons from lost-record notes and quoting prospect language from notes/messages in the report, which can process and surface sensitive free-text content without any warning, consent check, or redaction rules. Notes and messages often contain personal data, confidential deal details, or privileged internal commentary, so extracting quotes into a report materially increases the risk of privacy leakage and overexposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description and metadata position the skill as a general-purpose operator for broad categories of CRM activity ('work, deals, pipeline or Kanban updates, follow-up tasks, reports, prospect research, inbox contact detection, CRM setup'). This can cause the skill to trigger on loosely related user requests and perform sensitive CRM actions in situations where the user did not intend to invoke this specific automation flow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The statement that 'Anything not listed above is still in scope' effectively removes meaningful scope boundaries. In a high-privilege CRM skill, that increases the chance of unintended invocation and tool use across records, inbox, tasks, and metadata based on vague user phrasing.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The skill repeatedly directs the agent to act without asking permission in cases that can change CRM state, including leaving breadcrumbs automatically and minimizing questions unless they change output. In a CRM context, this encourages autonomous writes, task creation, record movement, and notes activity that may be incorrect, privacy-sensitive, or operationally disruptive if the agent misinterprets intent.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
These rules exist because the user explicitly asked for **speed, error-proofing, and minimal actions**. Violating any of them creates work for the user. - **Authenticate once.** Never ask the user to re-authenticate mid-session. If a tool call returns an auth error, surface it once with a one-tap reconnect path. Don't loop. - **Cache discovery aggressively.** A second call to `workspaces_list`, `crm_objects_list`, or `crm_fields_list` for the same object in the same session is a bug. Reuse the IDs you already hold. - **Verify before mutating.** Before `records_update`, `records_archive`, `tasks_create`, `tasks_complete`, `notes_update`, or any `crm_*_delete`, confirm the target ID exists from a prior read. Never trust speculative IDs. - **Never create duplicates.** Before creating a record, task, or note, check for an equivalent. For tasks: call `tasks_list` on the record and bail if an open task with the same intent and a due date in the next 7 days already exists. For records: see the duplicate-detection rules in `references/action-contact-detection.md`.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 92% confidence
Finding: This is autonomous decision-making because the skill directs the agent to decide, create, enrich, skip, and link records during scheduled runs without interactive confirmation. In a CRM context this is risky because classification mistakes, false duplicate matches, or overbroad inbox interpretation can silently alter business records and relationship history.
Content: Scanner excerpt · references/action-contact-detection.md (reported line 122)May include surrounding context.
md
- **Page size:** every `inbox_conversations_search` / `inbox_conversations_list` / `records_list` call uses **`limit: 20`**. This is non-negotiable — larger pages exceed the inline payload threshold on common agent runtimes, get saved to a file, and trigger the model's confidence-loss cascade. - **Main thread only:** every tool call runs directly in the agent's main thread. Do **not** invoke any sub-agent / task-delegation tool. Contact detection in particular is sensitive to this: sub-agents lose the cached duplicate-check state and may create the same record twice. - **Small-batch first for one-shot runs:** process only the first 20 conversations of the cohort, decide and create, then surface results and ask the user "say *continue* to sweep the rest." Scheduled runs proceed end-to-end without confirmation. 1. **Discover** (cached): workspace, Person object, Person fields (especially email, LinkedIn, phone, company, source, status), existing Person records (you'll need them indexed for duplicate detection). Crucially, also pull the **user's CRM taxonomy** so you can evaluate category-fit (per the 95% confidence rule above): - Pipeline stage option labels via `crm_field_options_list` on the stage field.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/action-contact-detection.md (reported line 180)May include surrounding context.
md
## Memory pattern — use custom activities aggressively The user explicitly asked: *"when running this action, if you believe that creating a custom activity with explanations for both the user and yourself as mini extended context memory can help you for future updates and let the user why you did what you did, then do it without asking the user."* So: - One custom activity per record touched per run.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough to activate on many ordinary CRM-related requests, which increases the chance the skill will launch a high-impact workspace reconfiguration workflow when the user intended something narrower. In this skill, activation can lead to scraping, structural CRM changes, and background record updates, so ambiguous triggering materially raises the risk of unintended destructive or privacy-affecting actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs the agent to fetch and scrape the user's site and key pages automatically, but does not require a clear user-facing disclosure that network access and content retrieval will occur. This can surprise users, expose browsing targets or business data to external systems, and create privacy/compliance issues when the agent expands beyond the single URL to additional pages.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: The skill encourages minimizing user questioning and then 'ship' the plan after a single confirmation, while the broader procedure includes renaming objects, creating/deleting fields and options, reordering views, and silently sweeping existing records in the background. In this context, reduced user interaction increases the risk of unauthorized or mistaken autonomous modifications to business-critical CRM data and can hide destructive changes until after they occur.
Content: Scanner excerpt · references/action-crm-setup.md (reported line 271)May include surrounding context.
md
- Don't create more than 1 pipeline by default (2 only with reason). - Don't exceed 5 / 3 / 3 / 4 view caps. - Don't use 4+ word names anywhere. - Don't ask the user 20 questions — make the plan, present it once, then ship. - Don't expose `_id`-style internal names in user-facing labels. ## Routine cadence

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/action-pipeline.md (reported line 21)May include surrounding context.
md
### Don't ask about obvious stages If the pipeline reads cleanly (e.g., `New → Contacted → Qualified → Proposal → Negotiation → Won` or `Lost`), don't ask the user what each stage means. Operate from common sense. ### Ask only on **unclear or non-standard terminology**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This instruction authorizes the agent to perform persistent CRM writes (records_update and custom_activities_create) automatically, but it does not require a clear user-facing warning or confirmation at the moment the write occurs. In a CRM context, silent stage changes and audit-note creation can alter pipeline state, reporting, workflows, and historical records based on heuristic inference, making mistaken or over-broad modifications hard to detect and reverse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly directs the agent to create persistent custom activities "without asking," which removes an important consent checkpoint for writing to CRM history. Because these notes become durable audit artifacts and may be consumed by users, teammates, or downstream automations, incorrect or overly verbose breadcrumbs can create privacy, integrity, and trust issues.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: This is autonomous decision-making tied directly to external side effects: the agent is told to decide and persist CRM activity records without requesting approval per action. In a system that infers intent from conversations and notes, this can lead to unsupervised writes, propagation of incorrect interpretations, and user surprise when records are modified or annotated automatically.
Content: Scanner excerpt · references/action-pipeline.md (reported line 183)May include surrounding context.
md
## Optional but valuable: the breadcrumb-as-memory pattern Always write a `custom_activities_create` for every decision (MOVE, STAY-with-strong-signal, FLAG). The user said: *"if you believe that creating a custom activity with explanations for both the user and yourself as mini extended context memory can help you for future updates and let the user know why you did what you did, then do it without asking."* Do it. It's the difference between an automation that gets smarter every run and one that re-litigates the same decisions.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to perform external web research and then write findings back into CRM notes with minimal up-front disclosure to the user. That creates a consent and data-integrity risk: users may not realize that external sources are being queried and that CRM records will be modified automatically based on those results.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: This is autonomous decision-making because the agent is empowered to decide when confidence is 'high' and then mutate structured CRM data without asking the user. In a CRM context, those decisions can materially alter business records and trigger downstream user actions or automation based on potentially incorrect enrichment.
Content: Scanner excerpt · references/action-prospect-research.md (reported line 147)May include surrounding context.
To find linked deals: look at the record's relation fields (linked records) and find the related Deal records. If unsure of the relation field name, inspect via crm_fields_list for fields of type relation.

Update structured fields when high-confidence facts are available. If you found a clean company size, industry, headquarters location, LinkedIn URL and the record has empty fields for any of these, update them with records_update. This makes future segmentation and reporting (Action 3) sharper. Don't overwrite non-empty fields without asking.

Breadcrumb. custom_activities_create with prefix:

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill authorizes automatic records_update changes to structured CRM fields when the fields are empty, without a confirmation step. Even if limited to empty fields, incorrect matching, stale sources, or low-quality enrichment can silently pollute canonical CRM data and affect segmentation, reporting, and downstream automations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list is broad enough to activate on common requests like 'give me a report' or 'show me the numbers,' which can cause the skill to run high-privilege CRM and inbox introspection without the user clearly intending this specific reporting workflow. In this skill's context, that increases the chance of over-collection and unintended disclosure of sensitive business data because the action reads multiple data sources and may generate or send reports.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow defaults recurring reports to weekly email delivery and focuses setup on cadence rather than explicit consent to transmit CRM and inbox-derived data over email. Email is a lower-trust channel with forwarding, mailbox compromise, and retention risks, so defaulting to it can expose sensitive pipeline, candidate, community, or client data beyond the intended workspace context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Line L133 explicitly instructs the agent to avoid any "Generated by AI" footer. This is a natural-language policy concern because it directs concealment of AI involvement rather than offering the user a choice about attribution or disclosure.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/fundamentals.md (reported line 64)May include surrounding context.
md
- **Never make a dedicated probe call just to learn the user's ID.** Don't create a test record, test activity, or test task whose only purpose is to read the creator ID off the response. That's wasted budget and risks leaving an orphan record. The user ID will surface on the first *legitimate* write of the session — wait for that. - **Never leave `assigneeUserIds` empty/null on tasks the agent creates on the user's behalf.** Unassigned tasks vanish from everyone's queue and the user thinks the workflow silently failed. If you genuinely have no user ID after the steps above, create the task, read the ID from the response, then `tasks_update` to add the assignee. That's an extra call but it's the price of correctness. - **Never ask the user "what's your user ID?"** They don't know it (it's an opaque string like `hs7wgdn9n31gbw7232j2w5wr6x84jbr9`). Resolve it from API responses. - **Don't assume one workspace's member list applies to another.** If the user switches workspaces mid-session (rare), re-resolve. Workspace-scoped IDs aren't portable. ## 4. Schema discovery — lazy and cached

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 84% confidence
Finding: The instruction to run scheduled routine jobs end-to-end without confirmation authorizes autonomous CRM mutations after initial setup. In a system that can create tasks, notes, activities, and update pipeline data, this increases the risk of silent large-scale changes if criteria are wrong, stale, or manipulated by prior context.
Content: Scanner excerpt · references/fundamentals.md (reported line 256)May include surrounding context.
md
- Never delegate any step of this loop to a sub-agent. - Process each page completely before fetching the next. - For one-shot user-initiated runs, **stop after the first page** and ask the user to confirm "continue" before sweeping the rest. (See SKILL.md universal rule "Small-batch first for one-shot runs.") - For scheduled routine runs, run end-to-end without confirmation. ### Reading data from the list response

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Company — {company name}

SkillSpector

Ae1

Hidden Instructions

Missing User Warnings

Missing User Warnings

Missing User Warnings

Vague Triggers

Vague Triggers

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Vague Triggers

Missing User Warnings

Autonomous Decision Making

Autonomous Decision Making

Missing User Warnings

Missing User Warnings

Autonomous Decision Making

Missing User Warnings

Autonomous Decision Making

Missing User Warnings

Vague Triggers

Missing User Warnings

Natural-Language Policy Violations

Autonomous Decision Making

Autonomous Decision Making

Static analysis