ClawHub
Back to skill

Security audit

Omnium Hub CRM

Security checks for vulnerabilities and agentic risk

Overview

This CRM skill is not proven malicious, but it needs review because it asks for a live API key and can send or change CRM data through an under-disclosed external service.

Install only after confirming that LeadConnectorHQ is the intended Omnium Hub API provider, using a narrowly scoped and revocable API key, and accepting that contact and opportunity data may be transmitted and printed in logs. Prefer a version that reads secrets from protected storage or environment variables and documents the exact supported actions and external hosts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/omnium_client.py:107
Finding

Bearer API Key Exposed Through Command-Line Arguments

Content
View full analysis
`python3 scripts/omnium_client.py --api-key "..." contacts --action lookup --email "john@example.com"` * "Add Jane Doe (jane@test.com) to Omnium Hub." -> `python3 scripts/omnium_client.py --api-key "..." contacts --action create --first-name "Jane" --last-name "Doe" --email "jane@test.com"` ``` ```python def main(): parser = argparse.ArgumentParser(description="Omnium Hub CRM Client") parser.add_argument("--api-key", required=True, help="Omnium Hub API Key (Bearer Token)") ``` ### Technical Analysis The Skill explicitly instructs the agent or user to pass a bearer API key as a command-line argument. Command-line secrets can be exposed through: - Shell history and terminal transcripts. - Agent command logs, execution telemetry, and audit records. - Process listings or process inspection available to other local users while the client is running. - Error reports or debugging output that records the complete invocation. - Automation systems that retain generated commands. Bearer tokens normally grant access without further proof of identity. Anyone obtaining the token can use it independently until it expires or is revoked. Passing the token to the CRM API is necessary for the declared functionality, but exposing it through the process argument vector is not necessary and violates least-exposure principles. ### Attack Path 1. A user provides an Omnium Hub API key to the agent as instructed. 2. The agent constructs a command containing the plaintext key in th ...[truncated 1259 chars]
Remediation
View remediation

other

Warning
Location
scripts/omnium_client.py:6
Finding

Undisclosed Transmission of Credentials and Customer PII to a Differently Branded External Service

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill description promises broad CRM and appointment management behavior, while the visible instructions only cover contacts and opportunities and the analysis indicates use of LeadConnectorHQ endpoints rather than clearly scoped Omnium Hub appointment resources. This mismatch can mislead operators about what the skill really does, reducing informed consent and making unauthorized or unexpected external actions harder to detect.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly asks the user to provide an API key and instructs that it be used in scripts, but gives no safety guidance on secret handling. This encourages collection of sensitive credentials in conversation and likely exposure via command-line arguments, logs, shell history, or downstream tooling, which is especially dangerous because the key grants live CRM access.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill invokes a Python client that performs networked CRM operations, but the skill manifest does not declare any tool scope or allowed-tools boundaries. This weakens enforcement and review because the agent may use capabilities broader than what is explicitly disclosed, increasing the chance of unintended external data access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The phrase 'Use for all CRM-related tasks' gives the skill an overly broad activation scope, which can cause it to be selected for requests far beyond the implemented and reviewed functionality. Overbroad routing increases the risk of unnecessary access to customer data and of the skill being used in contexts where its limitations and side effects are not understood.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code transmits contact PII such as first name, last name, email, and phone number via HTTP POST and PUT requests to an external service. While errors are printed, there is no confirmation prompt, user-facing disclosure, or explanatory comment/docstring warning that user data will be sent off-system.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/omnium_client.py (reported line 57)May include surrounding context.

python
# Remove None values
        payload = {k: v for k, v in payload.items() if v}
        
        resp = requests.post(url, headers=headers, json=payload)
        data = handle_response(resp)
        print(json.dumps(data, indent=2))

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/omnium_client.py (reported line 105)May include surrounding context.

python
# Remove None values
        payload = {k: v for k, v in payload.items() if v}
        
        resp = requests.post(url, headers=headers, json=payload)
        data = handle_response(resp)
        print(json.dumps(data, indent=2))

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/omnium_client.py (reported line 74)May include surrounding context.

python
}
        payload = {k: v for k, v in payload.items() if v}

        resp = requests.put(f"{url}/{args.contact_id}", headers=headers, json=payload)
        data = handle_response(resp)
        print(json.dumps(data, indent=2))

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The create opportunity path issues a POST request containing pipeline, stage, title, and contact linkage data to a remote service. The script does not provide a confirmation, visible disclosure, or documentation comment warning the user that CRM data will be transmitted externally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.