ClawHub
Back to skill

Security audit

Highlevel 1.0.7

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real GoHighLevel CRM helper, but it exposes broad live business actions without built-in confirmation safeguards.

Install only with a least-privilege sub-account integration unless you truly need agency-wide access. Treat the token like a password, avoid typing it on shared or recorded terminals, and require your own explicit confirmation before any delete, send, billing, social posting, workflow, bulk, or agency-level action.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
scripts/setup-wizard.py:121
Finding

Bearer Token Exposed Through Echoed Terminal Input

Content
View full analysis

Vulnerability Details

File Location: scripts/setup-wizard.py, line 121
Vulnerability Type: Plaintext sensitive credential input
Risk Level: Low

Vulnerable Code

python
token = input(f"{CYAN}  Enter your Private Integration token: {RESET}").strip()

Technical Analysis

The setup wizard uses Python's standard input() function to collect a GoHighLevel Private Integration bearer token. Terminal echo remains enabled while input() is active, so every character of the token is displayed as the user types it.

This can expose the credential through shoulder surfing, screen sharing, terminal session recording, screenshots, or other mechanisms that capture visible terminal content. The code does not intentionally transmit the token to an unauthorized service: subsequent network requests are constrained to the declared GoHighLevel API host, https://services.leadconnectorhq.com. Sending the bearer token to that host is necessary for the Skill's declared CRM functionality.

Attack Path

  1. A user runs scripts/setup-wizard.py without HIGHLEVEL_TOKEN already configured.
  2. The wizard prompts the user for a Private Integration token.
  3. The user enters the token through input(), causing it to appear visibly in the terminal.
  4. An observer, screen-sharing participant, terminal recorder, or captured screenshot obtains the token.
  5. The attacker submits the token as a bearer credential to the GoHighLevel API.
  6. The attacker can access or modify resources permitted by the token's configured scopes until the token is revoked or rotated.

Impact Assessment

Compromise grants the attacker the same API privileges as the affected Private Integration token. Depending on the scopes assigned by the user, this may include reading CRM contacts and conversations, sending messages, modifying opportunities, managing calendar data, or accessing invoices and payment-related records.

The impact is bounde ...[truncated 247 chars]

Remediation
View remediation

Remediation Suggestions

Use getpass.getpass() so the credential is collected with terminal echo disabled:

python
from getpass import getpass

token = getpass(
    f"{CYAN}  Enter your Private Integration token: {RESET}"
).strip()

Additional hardening measures:

  • Prefer preconfigured environment variables or a protected secret manager over interactive credential entry.
  • Never place bearer tokens in command-line arguments, diagnostic output, exception messages, or persistent logs.
  • Continue masking tokens when reporting configuration status.
  • Recommend sub-account integrations and only the minimum scopes required for the user's intended operations.
  • Restrict access to terminal recordings and CI/CD logs.
  • Rotate the token immediately if it may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (35)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The skill documents destructive delete operations for custom fields, and the overall skill framing presents broad natural-language control over CRM resources without stating strong confirmation gates for destructive actions. In a business system, deleting custom fields can irreversibly break automations, forms, reporting, and downstream integrations, making accidental or manipulated invocation materially dangerous.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md
|    | | | `GET /locations/{id}/customFields` — List | |
|    | | | `POST /locations/{id}/customFields` — Create | |
|    | | | `PUT /locations/{id}/customFields/{fid}` — Update | |
|    | | | `DELETE /locations/{id}/customFields/{fid}` — Delete | |
|    | | | **Custom Values CRUD:** | |
|    | | | `GET /locations/{id}/customValues` — List | |
|    | | | `POST /locations/{id}/customValues` — Create | |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The documented delete capability for custom values enables destructive modification of location configuration data, and the skill does not present clear operator safeguards around such actions. Because these values may drive templates, automations, and configuration state, deletion can cause service disruption or subtle business logic failures.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md
|    | | | `GET /locations/{id}/customValues` — List | |
|    | | | `POST /locations/{id}/customValues` — Create | |
|    | | | `PUT /locations/{id}/customValues/{vid}` — Update | |
|    | | | `DELETE /locations/{id}/customValues/{vid}` — Delete | |
|    | | | **Tags CRUD:** | |
|    | | | `GET /locations/{id}/tags` — List | |
|    | | | `POST /locations/{id}/tags` — Create | |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The skill exposes tag deletion operations, which can alter segmentation, trigger logic, campaign enrollment behavior, and reporting across the CRM. Given the natural-language interface and lack of explicit documented safety interlocks, an attacker or mistaken user prompt could cause broad unintended state changes affecting many contacts and automations.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md
|    | | | `GET /locations/{id}/tags` — List | |
|    | | | `POST /locations/{id}/tags` — Create | |
|    | | | `PUT /locations/{id}/tags/{tid}` — Update | |
|    | | | `DELETE /locations/{id}/tags/{tid}` — Delete | |
| 11 | **Users** | `/users/` | CRUD, filter by email/role | `users` |
| 12 | **Forms** | `/forms/` | List forms, get submissions | `forms` |
| 13 | **Surveys** | `/surveys/` | List surveys, get submissions | `surveys` |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

md
- **"Rotate and expire later"** — new token generated, old token stays active for 7-day grace period
  - **"Rotate and expire now"** — old token invalidated immediately (use for compromised credentials)
  - You can edit scopes without regenerating the token
- **OAuth tokens** (marketplace apps only): Access tokens expire in 24 hours (86,399s); refresh tokens last up to 1 year
- Agency tokens can access sub-account data by passing `locationId` parameter
- **Rate limits are per-resource** — each sub-account independently gets 100/10s burst + 200K/day. SaaS endpoints: 10 req/sec global
- All list endpoints default to 20 records, max 100 per page via `limit` param

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md
## Webhook Events

50+ webhook event types for real-time notifications. Key events: `ContactCreate`, `ContactDelete`, `ContactTagUpdate`, `InboundMessage`, `OutboundMessage`, `OpportunityCreate`, `OpportunityStageUpdate`, `OpportunityStatusUpdate`, appointment events, payment events, form submission events. Webhooks continue firing even if access token expires. Config is per marketplace app.
Docs: https://marketplace.gohighlevel.com/docs/webhook/WebhookIntegrationGuide

## Official SDKs & Developer Resources

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/conversations.md (reported line 13)May include surrounding context.

md
| GET | `/conversations/{conversationId}` | Get conversation |
| POST | `/conversations/` | Create conversation |
| PUT | `/conversations/{conversationId}` | Update conversation |
| DELETE | `/conversations/{conversationId}` | Delete conversation |
| POST | `/conversations/messages` | Send message |
| POST | `/conversations/messages/inbound` | Add inbound message |
| POST | `/conversations/messages/upload` | Upload attachment |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 38)May include surrounding context.

text

## OAuth Token Lifecycle (Marketplace Apps Only)
- Access tokens expire in **24 hours** (86,399 seconds)
- Refresh tokens last up to **1 year**
- Private Integration tokens do NOT expire (but 90-day rotation recommended)
- `/oauth/token` is the ONLY endpoint that does NOT require the `Version` header

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/setup-wizard.py (reported line 102)May include surrounding context.

python
header("Step 2: Setting Up Your Private Integration")

    # If token not set, show instructions then prompt
    if not token_ok:
        p(f"""
  {BOLD}How to get your Private Integration token:{RESET}

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/setup-wizard.py (reported line 125)May include surrounding context.

python
header("Step 2: Setting Up Your Private Integration")

    # If token not set, show instructions then prompt
    if not token_ok:
        p(f"""
  {BOLD}How to get your Private Integration token:{RESET}

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises code-driven capabilities that require environment variable access and outbound network access, but it does not declare an explicit permission or allowed-tools scope. That omission weakens reviewability and user consent because operators cannot easily see that the skill can read sensitive credentials and perform live API actions against an external CRM.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description emphasizes convenience and breadth of automation but does not clearly warn users that it can send messages, create invoices, alter records, and trigger externally visible business actions. This increases the chance of accidental misuse, especially when invoked through natural language, because users may not realize that requests can have real-world side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup instructions ask the user to export a private integration token and location ID without clearly labeling the token as highly sensitive credential material. That can lead to unsafe handling such as storing it in shell history, screenshots, shared terminals, or logs, increasing the chance of credential compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This reference section documents schema and record update/delete operations for custom objects and associations without any caution that these calls can permanently modify or remove customer data. In a natural-language agent skill, exposing destructive endpoints without confirmation guidance or risk labeling increases the chance of accidental or unauthorized data loss through prompt misuse, misunderstanding, or overbroad agent actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation lists document-send, template-send, and snapshot share-link endpoints without warning that these actions may distribute sensitive business information or create externally accessible links. In an AI assistant context, such omissions can lead users or agents to trigger external sharing actions without understanding visibility, audience, or revocation implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

These SaaS and billing-related endpoints can enable, disable, or alter subscriptions at scale, yet the reference provides no warning about service disruption, customer-impacting changes, or billing consequences. In a CRM-integrated agent skill, such operations are especially dangerous because a mistaken natural-language instruction could trigger widespread account changes affecting many locations or customers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Describing call-log access and installation deletion without privacy or destructive-operation warnings understates the sensitivity of voice records and the operational impact of uninstall actions. In this skill, call logs may contain personal or regulated data, and deleting installations can break integrations or revoke functionality unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file lists DELETE endpoints for calendars and appointments, which can affect user data and system integrity, but provides no warning or cautionary note about deletion impact. Under the markdown-specific SQP-2 criteria, descriptions of destructive behavior should include user-facing warnings when they can modify or remove data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file lists multiple destructive or integrity-impacting operations such as deleting contacts, notes, tasks, and removing contacts from campaigns or workflows, but provides no warning about their effect on user data or the need for caution. Under the markdown-specific SQP-2 criteria, descriptions that omit warnings for behaviors affecting user data or system integrity should be flagged.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file lists DELETE /invoices/{invoiceId} and POST /invoices/{invoiceId}/void as available actions, but provides no warning that these operations can irreversibly affect billing records or business data. For markdown files, destructive behaviors that could affect user data or system integrity should be accompanied by an explicit warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file documents DELETE /products/{productId} and POST /products/bulk-update with no warning that they can remove or modify product data at scale. In markdown documentation, operations that may materially change user data should include a clear caution about scope and reversibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file documents DELETE operations for opportunities and followers, but it does not include any warning that these actions may remove data or alter records. Under the markdown-specific warning criteria, destructive behaviors that can affect user data or system state should be disclosed to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The troubleshooting guide includes a live POST example that creates a real contact in the user's CRM, but it is presented as a simple connectivity test without an explicit warning that it mutates production data. In an agent-skill context, users may copy/paste or automation may surface this snippet directly, causing unintended writes, test records, downstream workflow triggers, or compliance issues in a live tenant.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 29)May include surrounding context.

md
--header "Version: 2021-07-28" | head -c 200

# Test POST — Create a contact:
curl --request POST \
  --url https://services.leadconnectorhq.com/contacts/ \
  --header "Authorization: Bearer $HIGHLEVEL_TOKEN" \
  --header "Content-Type: application/json" \

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/ghl-api.py (reported line 364)May include surrounding context.

python
def create_contact_task(contact_id, data):
    """Create a task for a contact.
    data: dict with task details (title, dueDate, etc.)
    """
    cid = _validate_id(contact_id, "contact_id")

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description frames the tool as a CRM/location-management helper, but the code also exposes agency-level snapshot enumeration and status APIs. That creates a scope mismatch: a user or orchestrating agent may invoke higher-privilege operations than expected, increasing the chance of unauthorized access to agency-wide assets when powerful tokens are present.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.