Zoho CRM MCP

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:43 AM UTC
• Version: 1.4.1

Overview

This is a coherent Zoho CRM connector, but users should treat the MCP URL as a secret and avoid the documented fixed /tmp argument files.

Install only for agents that should access your Zoho CRM, start with read-only OAuth scopes, and enable create/update/delete tools only when needed. Treat ZOHO_MCP_URL like a password: do not echo it in logs or screenshots, avoid long-lived shell-profile storage where possible, and rotate it if exposed. Prefer the bundled Python helpers or secure temporary files instead of the fixed /tmp examples.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:71

Finding

Predictable Temporary Files Permit Symlink-Based File Overwrite

Content

View full analysis

/tmp/zoho_search.json { "path_variables": {"module": "Contacts"}, "query_params": {"criteria": "(Last_Name:equals:Smith)"} } EOF mcporter call "$ZOHO_MCP_URL.ZohoCRM_searchRecords" --args "$(< /tmp/zoho_search.json)" ``` `SKILL.md:82-87`: ```bash cat << 'EOF' > /tmp/zoho_record.json { "path_variables": {"module": "Accounts", "recordID": "1234567890"} } EOF mcporter call "$ZOHO_MCP_URL.ZohoCRM_getRecord" --args "$(< /tmp/zoho_record.json)" ``` `SKILL.md:92-97`: ```bash cat << 'EOF' > /tmp/zoho_coql.json { "body": {"select_query": "SELECT Id, Account_Name, Website FROM Accounts WHERE Website != '' ORDER BY Account_Name LIMIT 50"} } EOF mcporter call "$ZOHO_MCP_URL.ZohoCRM_executeCOQLQuery" --args "$(< /tmp/zoho_coql.json)" ``` `SKILL.md:190-197`: ```bash cat << 'EOF' > /tmp/args.json { "path_variables": {"module": "Contacts"}, "query_params": {"criteria": "(Email:equals:[e-mail])"} } EOF mcporter call "$ZOHO_MCP_URL.ZohoCRM_searchRecords" --args "$(< /tmp/args.json)" ``` Equivalent vulnerable examples appear in `README.md:80-86`, `README.md:92-97`, `README.md:103-108`, and `README.md:177-183`. ### Technical Analysis The shell redirection operator (`>`) opens an existing destination with truncation enabled and follows symbolic links. The documented filenames are fixed and predictable within the shared `/tmp` namespace. The commands do not: - Create files atomically with exclusive semantics. - Verify file ownership or re ...[truncated 2158 chars]

Remediation

View remediation

"$args_file" <<'EOF' { "path_variables": {"module": "Contacts"}, "query_params": {"criteria": "(Last_Name:equals:Smith)"} } EOF mcporter call "$ZOHO_MCP_URL.ZohoCRM_searchRecords" \ --args "$(< "$args_file")" ``` For workflows requiring several files, create a private temporary directory: ```bash tmp_dir="$(mktemp -d)" || exit 1 chmod 700 "$tmp_dir" trap 'rm -rf -- "$tmp_dir"' EXIT HUP INT TERM args_file="$tmp_dir/args.json" ``` Additional hardening measures: 1. Never recommend predictable filenames in shared temporary directories. 2. Quote every generated path. 3. Apply permissions of `0600` to files containing request data. 4. Register cleanup immediately after successful temporary-file creation. 5. Avoid running these examples as a privileged user. 6. Where practical, use the bundled Python helpers or pass serialized JSON directly as an argument, eliminating temporary files entirely. 7. Update all duplicate examples in both documentation files so users are not directed back to an unsafe pattern. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

echo $ZOHO_MCP_URL

text

Treat `ZOHO_MCP_URL` like a password. It contains CRM access credentials.

## How to Get Your MCP URL

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill documentation clearly expects access to environment variables and shell execution (ZOHO_MCP_URL, mcporter, Python scripts), but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, that mismatch can cause over-broad execution or make reviewers underestimate that the skill can invoke local commands and access credential-bearing environment data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation instructs users to persist a credential-bearing MCP endpoint in shell profiles and echo it for verification, but does not prominently warn that the URL itself functions like a secret token. Because the token is embedded in the URL, storing it in long-lived profiles, command history, logs, screenshots, or terminal output increases the risk of credential leakage and unauthorized CRM access.

Content

No source excerpt is available for this finding.

Tainted flow: 'cmd' from os.environ.get (line 56, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/list_accounts.py (reported line 57)May include surrounding context.

python

sys.exit(1)

    cmd = ["mcporter", "call", f"{MCP_URL}.{tool}", "--args", json.dumps(args, ensure_ascii=False)]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, check=False)
    try:
        return json.loads(result.stdout)
    except json.JSONDecodeError:

Tainted flow: 'cmd' from os.environ.get (line 58, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/list_contacts.py (reported line 59)May include surrounding context.

python

sys.exit(1)

    cmd = ["mcporter", "call", f"{MCP_URL}.{tool}", "--args", json.dumps(args, ensure_ascii=False)]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, check=False)
    try:
        return json.loads(result.stdout)
    except json.JSONDecodeError:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list_accounts.py (reported line 57)May include surrounding context.

python

"--args",
        json.dumps(args, ensure_ascii=False),
    ]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, check=False)
    try:
        return json.loads(result.stdout)
    except json.JSONDecodeError:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list_contacts.py (reported line 59)May include surrounding context.

python

"--args",
        json.dumps(args, ensure_ascii=False),
    ]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, check=False)
    try:
        return json.loads(result.stdout)
    except json.JSONDecodeError:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/search_records.py (reported line 38)May include surrounding context.

python

"--args",
        json.dumps(args, ensure_ascii=False),
    ]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, check=False)
    try:
        return json.loads(result.stdout)
    except json.JSONDecodeError:

Tainted flow: 'cmd' from os.environ.get (line 31, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/search_records.py (reported line 38)May include surrounding context.

python

"--args",
        json.dumps(args, ensure_ascii=False),
    ]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, check=False)
    try:
        return json.loads(result.stdout)
    except json.JSONDecodeError:

Static analysis

No suspicious patterns detected.