Security audit

ghl-integration

Security checks for vulnerabilities and agentic risk

Overview

The skill has a real CRM automation purpose, but it asks for live CRM tokens and broad account access while routing sensitive operations through unreviewed third-party and local components.

Review carefully before installing. Do not paste GHL or Meta tokens into chat, do not use the third-party gateway with reusable GHL bearer tokens unless you explicitly trust and have audited it, and do not run the referenced /root/.hermes scripts or zero-touch installer unless their source and permissions are verified. Webhooks should be HTTPS, authenticated, signed, tenant-bound, and logged before handling real leads or triggering CRM actions.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

other

Error

Location: SKILL.md:170
Finding: GHL bearer credentials are directed through a third-party gateway
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:32
Finding: Onboarding instructs users to disclose and persist reusable API secrets through chat
Content: View full analysis
💡 **DIRETRIZ OBRIGATÓRIA PARA A IA / ASSISTENTE:** > Ao iniciar o uso desta skill ou se as credenciais do GoHighLevel não estiverem configuradas no ambiente local: > 1. **NÃO encerre com erro técnico de conexão.** > 2. **Inicie imediatamente um diálogo de Onboarding Intuitivo, amigável e guiado.** > 3. **Solicite as informações necessárias**, explicando passo a passo onde o usuário as encontra no painel do GHL. > 4. **Execute uma validação automática (Health Check)** (`python3 scripts/ghl_client.py list-pipelines` ou `ghl_get_pipeline_opportunities`) logo após receber os dados para testar a comunicação com a sub-conta. ### 📋 Checklist de Credenciais do GoHighLevel 1. **`GHL_API_KEY` / Private Integration Token** *(Obrigatório)*: - *O que é:* Token de API v2 do GHL (Bearer Token ou Private Integration Access Token). ### 💬 Modelo de Mensagem de Boas-Vindas & Onboarding: ```text 1️⃣ Seu Token de Integração / API Key (`GHL_API_KEY`) 2️⃣ O ID da sua Localização/Sub-conta (`GHL_LOCATION_ID`, ex: `ocQn35zFGheEKuzrVAhu`) 👉 Como você prefere configurar? • Pode me passar os dados diretamente aqui no chat que eu salvo e testo agora mesmo. • Ou salve no arquivo `/root/.hermes/ghl/.env` (`export GHL_API_KEY="..."`). ``` ``` ### Technical Analysis The mandatory onboarding workflow asks the user to paste a reusable private integration token directly into the chat and promises to save it. Chat transcripts may be retained in agent sessions, model-provider logs, telemetry, backups, or support systems. The alternative `.env` storage instruction does not specify restrictive file permissions, ownership, encryption, redaction, or a secret-management system. The subsequent automatic health check can also expose the credential to an unreviewed script or third-party gateway. S ...[truncated 867 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:125
Finding: Webhook deployment uses plaintext HTTP without documented authentication or signature verification
Content: View full analysis
` ``` The multi-tenant guide further states: ```markdown 2. **Rota Multi-Tenant:** - URL: `http://:/webhook/` - O servidor sobrescreve dinamicamente a `GHL_LOCATION_ID` para a requisição em questão, permitindo que a mesma instância atenda múltiplos clientes ou subcontas sem conflito de rotas. ``` ### Technical Analysis The documented endpoint uses plaintext HTTP, exposing lead payloads to interception or modification while in transit. The documentation does not require webhook signatures, request authentication, replay protection, timestamps, nonce validation, source restrictions, or payload-integrity checks. For multi-tenant routing, a path-controlled `LOCATION_ID` dynamically overrides the active tenant. A location identifier is not an authentication credential. If server-side authorization does not independently bind a verified sender to the selected tenant, changing the path can cause cross-tenant event injection. The webhook server implementation is absent from the package, so no compensating validation can be verified. ### Attack Path 1. An attacker discovers or guesses the exposed webhook endpoint and a location identifier. 2. The attacker sends a forged HTTP POST to `/webhook/`. 3. The server selects the tenant from the attacker-controlled path. 4. In the absence of signat ...[truncated 640 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:137
Finding: Skill executes mutable scripts outside the reviewed package
Content: View full analysis
--msg-type "Email" --subject "Sua Proposta Chegou!" --message "Olá, segue aqui a sua proposta comercial." python3 /root/.hermes/metaads/ghl_client.py --action send_msg --contact-id --msg-type "WhatsApp" --message "Olá! Vimos seu cadastro no Instagram. Como podemos te ajudar?" ``` ### 2. Encontrar Leads Sem Resposta (Inbound pendentes) ```bash python3 /root/.hermes/metaads/ghl_client.py --action unanswered ``` ### 3. Mover Lead no Kanban (Mudar Etapa) ```bash python3 /root/.hermes/metaads/ghl_client.py --action update_opp_stage --opp-id --stage-id ``` ``` Other documented but absent files include: ```bash python3 /root/.hermes/metaads/ghl_webhook_server.py python3 scripts/ghl_client.py list-pipelines ./install.sh ``` ### Technical Analysis The audited package contains no `scripts` directory and does not include `ghl_client.py`, `ghl_webhook_server.py`, `instagram_follow_gate.py`, `ghl_kommo_client.py`, or `install.sh`. Nevertheless, the Skill instructs the agent to execute these files, including absolute paths under `/root/.hermes`. Absolute paths outside the installed package resolve to mutable local files whose contents are not covered by this Skill's review or package integrity. An attacker or another package able to create or replace a file at the expected path can cause a legitimate-looking Skill command to ex ...[truncated 1066 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:106
Finding: Skill directs the agent to search unrelated global session records
Content: View full analysis
" /root/.hermes/cron/output/*.txt grep -rhoi -E ".{0,300}" /root/.hermes/sessions/*.json | sort -u | head ``` ### Technical Analysis The second command recursively searches every JSON file in the global Hermes session directory and returns up to 300 characters preceding a matching domain. This is broader than the CRM reporting task and is not limited to the current user, current Skill, current tenant, or current session. Session files can contain private conversation content, identifiers, URLs with embedded tokens, credentials pasted into chat, and data belonging to unrelated tasks. The command therefore crosses a least-privilege boundary and can expose context surrounding a match even when only a domain lookup was intended. ### Attack Path 1. A report contains an unfamiliar domain or name. 2. The agent follows the troubleshooting instruction. 3. The agent searches all files under `/root/.hermes/sessions`. 4. A match from an unrelated session is returned together with up to 300 characters of surrounding content. 5. That content is incorporated into the current report or exposed to the current user. 6. Sensitive information from another session or tenant is consequently disclosed. ### Impact Assessment The command may disclose cross-session conversation content, personal information, internal URLs, authentication material, and data belonging to other users or tenants. It does not directly grant new operating-system privileges, but it abuses existing file access beyond the task's legitimate scope. ]]>
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/unanswered_leads_triaging_patterns.md:31
Finding: Lead-triage instructions expand into privileged administrative and database operations
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/zero_touch_and_webhooks.md:4
Finding: Zero-touch setup requests unrelated long-lived credentials and suppresses interactive safeguards
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 24)May include surrounding context.
🚀 Quick Onboarding & First-Time Setup

Get your Habilis MCP Token & GHL Credentials:

Access the developer portal at https://xvix.com.br to generate your access token.

Obtain your GHL Private Integration Token and Location ID in your GoHighLevel sub-account settings.

Configure Environment Variables:
bash

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
### 📋 Checklist de Credenciais do GoHighLevel 1. **`GHL_API_KEY` / Private Integration Token** *(Obrigatório)*: - *O que é:* Token de API v2 do GHL (Bearer Token ou Private Integration Access Token). - *Onde obter:* GHL Sub-Account ➡️ Settings ➡️ Business Profile / Developers ➡️ Private Integrations ➡️ Create Integration. 2. **`GHL_LOCATION_ID`** *(Obrigatório)*:

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The onboarding text tells users they can provide the GHL API key directly in chat and that the agent will save and test it. Asking for live credentials in chat without a clear warning or secure collection mechanism creates a high risk of credential disclosure through message logs, transcripts, screenshots, or downstream tool access.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill combines three risky behaviors in one flow: requesting live API credentials in chat, storing them locally, and immediately using them for a health check. This materially increases the chance of secret exposure and misuse because the token may persist in transcripts and files while also being exercised with potentially broad CRM permissions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README explicitly promotes autonomous contact creation, pipeline transitions, lead triage, workflow triggers, and direct multi-channel messaging, but does not warn that using the skill can modify CRM records or send outbound communications to real contacts. In an agent context, that omission is dangerous because operators may enable or invoke the skill without understanding it can take irreversible actions against customer data and external recipients.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrase "qualificar lead" is generic natural language that could overlap with common CRM-related conversation rather than a deliberate request to invoke this specific GoHighLevel skill. The manifest does not provide negative examples or contextual constraints to narrow when this trigger should or should not activate.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to solicit a live GHL API token and location ID from the user and to save them into a local environment file, expanding the skill from normal API use into credential collection and storage. This is dangerous because chat channels and agent-managed local files may be logged, retained, or exposed to other tools/processes, turning a CRM integration into a secret-handling workflow without strong safeguards.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The prescribed onboarding and success/error messages are written as fixed Portuguese-language templates and are presented as mandatory assistant behavior. The file does not offer user language selection or opt-in, which can violate language or locale policy expectations for flexible user-facing interactions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file’s instructional content is written in Portuguese and uses imperative language like 'Solução Obrigatória' and 'DEVE', effectively imposing a specific language/locale on users. There is no indication that this is a region-specific skill or that users can opt into Portuguese, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document is written entirely in Portuguese and does not indicate that language selection is optional or that the skill is explicitly limited to Portuguese-speaking users. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guidance for 'Suporte Crítico / Desbloqueio de Ativação' explicitly instructs operators to check an administrative panel and PostgreSQL to unblock a customer instance, but provides no authorization checks, least-privilege boundaries, or safety procedures. In a skill that helps triage leads and operational responses, this can normalize direct production-admin/database intervention and increase the chance of unauthorized access, unsafe manual changes, or disclosure/modification of sensitive customer data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation tells operators to export long-lived access tokens and API keys into the shell environment for unattended setup, but it provides no guidance on secret handling, scoping, rotation, or leakage risks. Environment variables are commonly exposed through shell history, process listings, crash dumps, logs, CI/CD output, or inherited child processes, so this creates a real credential exposure risk in an integration that can send messages, manage leads, and receive webhooks.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The skill includes human-approval controls for destructive CRM actions but omits comparable protections for saving sensitive credentials locally, despite onboarding telling the agent to accept and persist them. This inconsistency normalizes unsafe secret handling and can lead to credential leakage or unauthorized reuse if the local environment is shared, backed up, or later accessed by other automations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: This markdown file describes storing MANAGER_PHONE in environment or .env and using it for automated alerts, which involves handling personal contact information. The reference does not include any warning about privacy, sensitivity of the data, or safe handling expectations for that manager contact information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The document presents operational instructions and labels in both Portuguese and English, but does not clarify the intended language policy or whether users may choose their preferred language. This can amount to an implicit language constraint or inconsistent locale handling under organizational language-policy rules.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:117

Overview

A.I.G

other

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T07 · Tool Hijacking and Spoofing

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Credential Access

🚀 Quick Onboarding & First-Time Setup

Credential Access

Missing User Warnings

Ssd 3

Missing User Warnings

Vague Triggers

Context-Inappropriate Capability

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Natural-Language Policy Violations

Static analysis

File appears to expose a hardcoded API secret or token.