ClawHub
Back to skill

Security audit

HighLevel Agency & Builder MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill clearly describes its HighLevel access and requires previews and authorization before making account changes.

Connecting sends your credentials to Moosh Works. Use a narrowly scoped integration token and leave editing credentials empty for audits. For editing, use a dedicated restricted user, review each preview, and authorize publication separately. Disconnecting the app does not invalidate the underlying credentials; review the provider's privacy policy before connecting.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Page and workflow write operations exceed the manifest's advertised preview scope.

Medium
Category
Excessive Agency
Confidence
93% confidence
Finding

The manifest at L04 advertises previewing page and workflow changes, while explicitly advertising saving only for domain bindings. L32 instructs applying page changes, L34 supports saving and publishing workflows, and L44 provides the non-dry-run procedure. These instructions authorize persistent changes beyond the advertised preview scope, even though they require approval.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
80% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
- **Snapshot comparison:** Use `ghl_snapshot_diff_audit` with a user-supplied snapshot export, its ID, and at least one asset category. It compares custom values, custom fields, tags, and calendars. State that export ownership and freshness are unverified. Omitted categories remain unverified. It does not overwrite assets or fetch an arbitrary Master Snapshot.
- **Message references:** Use `ghl_custom_values_audit` to find blank custom values and unresolved placeholders in returned or supplied message templates. This audit does not repair values or send messages.
- **Phone routing:** Use `ghl_phone_wallet_audit` to inspect available numbers, pools, missing routing, and forwarding loops. State unavailable carrier access. Routing findings do not establish charges or savings.
- **Staff permissions:** Use `ghl_user_role_governance` to compare assigned staff with a selected permission preset. This audit does not assign roles, remove users, or revoke access.

## Apply and verify changes

Static analysis

No suspicious patterns detected.