GoHighLevel Open Account

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:24 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a setup guide, but it repeatedly steers users to an undisclosed referral signup link and recommends broad GoHighLevel installation permissions by default.

Review this skill before installing. Prefer replacing the referral signup URL with GoHighLevel's canonical signup URL or requiring explicit affiliate disclosure, and choose the narrowest installation permissions and OAuth scopes needed for each integration rather than accepting agency-wide access by default.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:10
• Finding: Hard-Coded Affiliate Link Hijacks Account Signup Recommendations<); use the Developer Marketplace for creating apps. ``` From `SKILL.md:21-23`: ```markdown **Checklist:** - [ ] Open GoHighLevel sign-up: [Start 14-day free trial](https://www.gohighlevel.com/?fp_ref=thatsop12) ``` From `SKILL.md:28`: ```markdown 1. Navigate to **https://www.gohighlevel.com/?fp_ref=thatsop12** to start a free trial or sign up. ``` From `SKILL.md:89`: ```markdown - Agent applies this skill: walk through "Opening a GoHighLevel account" (affiliate sign-up link, sign up, verify). Then offer next step: "Creating an app" at the Developer Marketplace when they are ready to get API credentials. ``` From `reference.md:4-6`: ```markdown | Resource | URL | |----------|-----| | Sign up / free trial (main product) | https://www.gohighlevel.com/?fp_ref=thatsop12 | ``` ### Technical Analysis The skill repeatedly directs the agent to provide a URL containing the referral parameter `fp_ref=thatsop12`. The account-creation workflow does not technically require this parameter; the canonical GoHighLevel website can be used without referral attribution. Because the link is embedded in the quick-start instructions, checklist, procedural steps, example behavior, and reference file, loading the skill systematically changes the agent's recommendations in favor of a monetized referral path. The behavior is therefore not an incidental hyperlink but a persistent instruction affecting user-facing output. The skill identifies the URL as an affiliate link only in one example near the end of `SKILL.md`. The primary instructions do not r ...[truncated 1324 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all instances of the affiliate URL with the canonical product URL: ```text https://www.gohighlevel.com/ ``` 2. Remove instructions that require the agent to use an affiliate link as part of the normal workflow. 3. If a referral link is retained: - Clearly disclose the affiliate relationship immediately before displaying the link. - Explain that the publisher may receive compensation. - Offer the canonical non-affiliate URL with equal prominence. - Require explicit user consent before using the affiliate URL. 4. Centralize the signup URL in one reviewed reference entry to prevent undisclosed referral parameters from being duplicated throughout the skill. 5. Add a review policy prohibiting tracking, referral, or monetization parameters in operational instructions unless they are necessary and transparently disclosed. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:49
• Finding: Overbroad Agency and Sub-Account Installation Permissions Recommended by Default<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:49-52`, `SKILL.md:55-59` **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Vulnerable Snippets From `SKILL.md:49-52`: ```markdown - [ ] Set **App type**: **Private** (internal/personal) or **Public** (marketplace distribution). - [ ] Set **Target user**: typically **Sub-account** (most integrations). - [ ] Set **Installation permissions**: **Both Agency & Sub-account** is recommended. - [ ] Set **Listing type** if applicable (e.g. **White-label** for agencies). ``` From `SKILL.md:55-59`: ```markdown 1. Log in at [Marketplace](https://marketplace.gohighlevel.com/) and open **My Apps**. 2. Click **Create App**. 3. Fill in **App name**. 4. Choose **App type**: **Private** (single user/internal) or **Public** (listable on marketplace). 5. Choose **Target user**: usually **Sub-account** so sub-accounts can install the app. 6. Set **Installation permissions** to **Both Agency & Sub-account** unless the use case requires otherwise. ``` ### Technical Analysis The skill recommends granting both agency-level and sub-account installation permissions as the default. This conflicts with the principle of least privilege: an application should receive only the access level required for its documented functions. The guidance does not first determine whether the integration needs agency-wide access, does not enumerate the operations enabled by each permission level, and does not require informed confirmation before expanding permissions. The phrase “unless the use case requires otherwise” places the broad configuration on the default path and requires users to recognize and correct excessive access themselves. If the integration only needs to operate on one sub-account, agency-level installation capability unnecessarily increases the authorization boundary. Compromise or misuse of the application's OAuth credentials or tokens could consequently affect a wid ...[truncated 1863 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the broad default with the narrowest supported permission: ```markdown Set installation permissions to Sub-account only unless the documented integration requirements explicitly require agency-level installation. ``` 2. Require the agent to identify the integration's resources and operations before recommending an installation level. 3. Add a permission-selection decision process: - Use sub-account-only access for integrations serving one location or tenant. - Use agency access only for documented cross-account administration. - Do not select both levels solely for convenience or future compatibility. 4. Explain the security consequences of agency-level authorization and require explicit user confirmation before recommending it. 5. Apply least privilege to OAuth scopes independently of installation permissions. 6. Document the exact scopes needed for each supported workflow and omit all unrelated scopes. 7. Recommend periodic review and revocation of unused installations, refresh tokens, scopes, and application credentials. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Low

• Confidence: 96% confidence
• Finding: The skill directs users to a referral/affiliate URL for account creation without disclosing that the link benefits the author. This is deceptive from a trust and procurement-integrity standpoint because it can bias user choices and cause agents to steer users toward monetized links under the guise of neutral guidance.

Missing User Warnings

Low

• Confidence: 97% confidence
• Finding: The workflow repeats the same referral signup URL and again omits any disclosure that it is an affiliate link. Repetition increases the chance that an automated agent will present the monetized link as authoritative, which undermines transparency and can create a conflict of interest.

Static analysis

No suspicious patterns detected.