T09 · Insecure Skill Coding Practices
Error
- Location
connect.py:43- Finding
Unvalidated Salesforce instance URL can expose bearer credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Salesforce Fast integrations
Security checks for vulnerabilities and agentic risk
Overview
This Salesforce skill has useful CRM features, but it needs Review because it can make large and persistent Salesforce changes with weak or misleading safeguards.
Install only after reviewing this as an administrative Salesforce tool, not just a CRM helper. Use a sandbox first, use a dedicated least-privilege Salesforce user, avoid storing long-lived passwords or admin tokens in .env, validate the Salesforce instance host, and do not run GTM standardization or automation deployment in production without an explicit preview, record counts, rollback plan, and admin approval.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
query.py:196- Finding
Dynamic SOQL construction permits query injection and bypasses intended data scope
- Content
View full analysis
Dict: """Get leads with optional filters""" default_fields = ['Id', 'Name', 'Email', 'Phone', 'Company', 'Status', 'LeadSource', 'CreatedDate', 'OwnerId'] query_fields = ', '.join(fields or default_fields) where_clause = "" if filters: conditions = [] for key, value in filters.items(): safe_value = sanitize_field_value(str(value)) if isinstance(value, str): conditions.append(f"{key} = '{safe_value}'") else: conditions.append(f"{key} = {safe_value}") if conditions: where_clause = f" WHERE {' AND '.join(conditions)}" query = f"SELECT {query_fields} FROM Lead{where_clause} ORDER BY CreatedDate DESC LIMIT {limit}" return run_soql(query, limit=limit) ``` The duplicate-check query additionally interpolates an unvalidated object and several unescaped values: ```python def check_duplicate_before_create(object_type: str, data: Dict) -> Dict: """Check if a record would be a duplicate before creating it""" sf = get_connection() if not sf: return {"success": False, "error": "Not connected to Salesforce"} try: conditions = [] if 'Email' in data and data['Email']: email = normalize_email(data['Email']) conditions.append(f"Email = '{email}'") if 'Phone' in data and data['Phone']: phone = data['Phone'] conditions.append(f"Phone = '{phone}'") if object_type == 'Lead' and 'Name' in data and 'Company ...[truncated 3454 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
standardize.py:327- Finding
Bulk standardization can modify up to 50,000 Salesforce records without confirmation
- Content
View full analysis
Dict: """ Write GTM fields to all unstandardized records. Processes in batches of 200 (Salesforce bulk API limit). """ taxonomy = _load_taxonomy() objects = SUPPORTED_OBJECTS if obj.lower() == "all" else [obj] summary = {} for sf_obj in objects: query = ( f"SELECT Id, Name, Title, Industry, Company, NumberOfEmployees " f"FROM {sf_obj} " f"WHERE {GTM_FIELDS['standardized']} = false OR {GTM_FIELDS['standardized']} = null " f"LIMIT 50000" ) try: data = sf.query_all(query) except Exception as exc: summary[sf_obj] = {"error": str(exc)} continue records = data.get("records", []) if not records: summary[sf_obj] = {"updated": 0, "skipped": 0, "errors": 0, "message": "No records need standardization."} continue updated = skipped = errors = 0 batches = [records[i:i + BATCH_SIZE] for i in range(0, len(records), BATCH_SIZE)] for batch_num, batch in enumerate(batches, 1): updates = [] for r in batch: gtm = _standardize_record(r, taxonomy) if not any(v for k, v in gtm.items() if k != GTM_FIELDS["standardized"]): skipped += 1 continue updates.append({"Id": r["Id"], **gtm}) if not updates or dry_run: skipped += len(batch) continue try: ...[truncated 2512 chars]- Remediation
View remediation
T06 · System Persistence
Error
- Location
automate.py:301- Finding
Automation deployment creates active persistent Salesforce validation rules with misleading non-blocking semantics
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (70)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Static analysis indicates the skill may actually perform focused GTM taxonomy backfill/standardization and rollback operations rather than the broad CRM functionality described. That mismatch matters because hidden field-standardization and rollback logic can still make bulk modifications to production Salesforce data while avoiding scrutiny from reviewers expecting generic CRM assistance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Static analysis indicates the skill may actually perform focused GTM taxonomy backfill/standardization and rollback operations rather than the broad CRM functionality described. That mismatch matters because hidden field-standardization and rollback logic can still make bulk modifications to production Salesforce data while avoiding scrutiny from reviewers expecting generic CRM assistance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Static analysis indicates the skill may actually perform focused GTM taxonomy backfill/standardization and rollback operations rather than the broad CRM functionality described. That mismatch matters because hidden field-standardization and rollback logic can still make bulk modifications to production Salesforce data while avoiding scrutiny from reviewers expecting generic CRM assistance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Static analysis indicates the skill may actually perform focused GTM taxonomy backfill/standardization and rollback operations rather than the broad CRM functionality described. That mismatch matters because hidden field-standardization and rollback logic can still make bulk modifications to production Salesforce data while avoiding scrutiny from reviewers expecting generic CRM assistance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Static analysis indicates the skill may actually perform focused GTM taxonomy backfill/standardization and rollback operations rather than the broad CRM functionality described. That mismatch matters because hidden field-standardization and rollback logic can still make bulk modifications to production Salesforce data while avoiding scrutiny from reviewers expecting generic CRM assistance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Static analysis indicates the skill may actually perform focused GTM taxonomy backfill/standardization and rollback operations rather than the broad CRM functionality described. That mismatch matters because hidden field-standardization and rollback logic can still make bulk modifications to production Salesforce data while avoiding scrutiny from reviewers expecting generic CRM assistance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Static analysis indicates the skill may actually perform focused GTM taxonomy backfill/standardization and rollback operations rather than the broad CRM functionality described. That mismatch matters because hidden field-standardization and rollback logic can still make bulk modifications to production Salesforce data while avoiding scrutiny from reviewers expecting generic CRM assistance.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill instructs users to place Salesforce username, password, and security token into a .env file, which normalizes direct handling of highly sensitive credentials by the skill environment. Even with a note not to commit the file, this increases risk of accidental disclosure through local compromise, backups, logs, shell tooling, or later agent access to environment variables.
- Content
Option C — Username + security token (.env):
bash # .env file (never commit to source control) SALESFORCE_USERNAME=your@email.com SALESFORCE_PASSWORD=<password> SALESFORCE_SECURITY_TOKEN=<security-token>
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
Mentioning verification of an access token is not itself malicious, but in the context of a skill that relies on environment-held tokens and potentially undeclared credential access paths, it reinforces a sensitive authentication model with insufficient boundary disclosure. The danger is indirect: it normalizes token-centric troubleshooting without clarifying how tokens are protected or sourced.
- Content
md **Problem**: "Authentication failed" **Solution**: 1. Check SALESFORCE_INSTANCE_URL is correct 2. Verify access token is valid (not expired) 3. Re-authenticate using OAuth flow 4. Check network connectivity
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The quick-start flow tells users to configure credentials in a .env file, encouraging secret placement in a location commonly read by tooling and potentially accessible to the agent runtime. In a skill that also advertises shell and file capabilities, the context makes environment-stored secrets more exposed than a normal documentation reference would be.
- Content
md # 1. Install pinned dependencies pip install -r requirements.txt # 2. Configure credentials in .env (never export raw secrets in shell) # Copy .env.example to .env and fill in your values — see README for details. # 3. Start using!
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
This line continues the same credential-handling pattern by directing users to populate .env with live secrets before using the skill. Because the skill is intended to automate CRM operations, any compromise of those secrets could lead to unauthorized access, data theft, or destructive changes in Salesforce.
- Content
md pip install -r requirements.txt # 2. Configure credentials in .env (never export raw secrets in shell) # Copy .env.example to .env and fill in your values — see README for details. # 3. Start using! # Say: "Show me all leads from this week"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description presents a CRM data-access/management integration, but this code performs org-wide metadata deployment by creating Salesforce Flows and Validation Rules. That is a materially more privileged and persistent capability than users would expect, increasing the risk of unauthorized administrative changes to the Salesforce org.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code and comments claim the validation rules are 'warning only' and 'never block saves', but standard active Salesforce validation rules block record saves when their condition evaluates true. This mismatch can cause unexpected production outages or data-entry failures because administrators may deploy the rule believing it is non-blocking.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The validation rule metadata itself says 'Does not block saves' while setting the rule active with an error formula and error message, which in Salesforce blocks the transaction. This is dangerous because it embeds deceptive operational semantics directly in deployment logic, making business disruption more likely during rollout.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code can pause, resume, and delete Salesforce Flows across the org, which is powerful lifecycle control beyond the stated CRM integration purpose. Hidden administrative controls are dangerous because an agent or user may invoke them without understanding that they can disable business processes or remove org automation.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Three authentication methods: 1. exchange — OAuth 2.0 authorization-code flow (Connected App) 2. refresh — Refresh an existing access token 3. platform — Extract token from Salesforce Platform CLI (sf / sfdx) No secrets needed — reads the token the CLI already stored.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Three authentication methods: 1. exchange — OAuth 2.0 authorization-code flow (Connected App) 2. refresh — Refresh an existing access token 3. platform — Extract token from Salesforce Platform CLI (sf / sfdx) No secrets needed — reads the token the CLI already stored.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Three authentication methods: 1. exchange — OAuth 2.0 authorization-code flow (Connected App) 2. refresh — Refresh an existing access token 3. platform — Extract token from Salesforce Platform CLI (sf / sfdx) No secrets needed — reads the token the CLI already stored.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Three authentication methods: 1. exchange — OAuth 2.0 authorization-code flow (Connected App) 2. refresh — Refresh an existing access token 3. platform — Extract token from Salesforce Platform CLI (sf / sfdx) No secrets needed — reads the token the CLI already stored.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Three authentication methods: 1. exchange — OAuth 2.0 authorization-code flow (Connected App) 2. refresh — Refresh an existing access token 3. platform — Extract token from Salesforce Platform CLI (sf / sfdx) No secrets needed — reads the token the CLI already stored.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Three authentication methods: 1. exchange — OAuth 2.0 authorization-code flow (Connected App) 2. refresh — Refresh an existing access token 3. platform — Extract token from Salesforce Platform CLI (sf / sfdx) No secrets needed — reads the token the CLI already stored.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python valid refresh token from a prior authorization-code flow. Returns metadata only — the new access token is NOT returned. Write it to your .env by calling connect.py connect afterward. """ endpoint = ( "https://test.salesforce.com/services/oauth2/token"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python valid refresh token from a prior authorization-code flow. Returns metadata only — the new access token is NOT returned. Write it to your .env by calling connect.py connect afterward. """ endpoint = ( "https://test.salesforce.com/services/oauth2/token"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html valid refresh token from a prior authorization-code flow. Returns metadata only — the new access token is NOT returned. Write it to your .env by calling connect.py connect afterward. """ endpoint = ( "https://test.salesforce.com/services/oauth2/token"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
html valid refresh token from a prior authorization-code flow. Returns metadata only — the new access token is NOT returned. Write it to your .env by calling connect.py connect afterward. """ endpoint = ( "https://test.salesforce.com/services/oauth2/token"
Static analysis
No suspicious patterns detected.