Zoho CRM MCP

• Outcome: Pass
• Latest audit: Jul 16, 2026 · 8:25 AM UTC
• Version: 1.4.1

Overview

This skill openly connects to a user-provided Zoho CRM MCP endpoint to read and query CRM data, with sensitive access that is expected for its purpose but should be scoped carefully.

Install only if you intend to let an agent access Zoho CRM. Start with read-only OAuth scopes, avoid enabling delete actions unless specifically needed, and treat ZOHO_MCP_URL like a password; prefer per-session secret injection over storing it permanently in a shell profile.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents and encourages use of shell commands and an environment variable containing a credential-bearing MCP endpoint, but it declares no corresponding permissions. That mismatch is a real security issue because an agent or runtime may execute the skill with broader capabilities than reviewers expect, and the URL token can grant CRM access if exposed through logs, prompts, shell history, or subprocess usage.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script sends CRM query contents and returns account data through an external MCP endpoint identified by a token-bearing URL, but it does not give a runtime warning, confirmation, or clear disclosure of the destination before transmission. In a skill context that handles customer CRM data, this increases the chance of unintentional data exposure to a wrong or attacker-controlled endpoint if the environment variable is mis-set.

Unvalidated Output Injection

High

• Category: Output Handling

Content

"--args",
        json.dumps(args, ensure_ascii=False),
    ]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, check=False)
    try:
        return json.loads(result.stdout)
    except json.JSONDecodeError:

• Confidence: 82% confidence
• Finding: The script accepts an endpoint from ZOHO_MCP_URL and forwards user-controlled module/query data to an external mcporter target without validating the destination. In this skill context, that can redirect sensitive CRM queries and returned data to an attacker-controlled MCP endpoint, causing data exfiltration or misuse of CRM operations even though there is no shell injection.

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.