Leads

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:40 AM UTC
• Version: 3.4.1

Overview

This is a straightforward local sales-lead manager, with a real privacy caveat around how its local CRM file permissions are handled.

Before installing, understand that lead information is stored locally in plaintext under `~/.leads/leads.json`. On a shared machine, set restrictive permissions on `~/.leads` and the JSON file or avoid storing sensitive customer and deal information there.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:9

Finding

Lead PII Stored with Unsafe Default File Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 9–16 and 100–101
Vulnerability Type: Sensitive data exposure through insecure filesystem permissions
Risk Level: Medium

Vulnerable Code

bash

DATA_DIR="${HOME}/.leads"
LEADS_FILE="${DATA_DIR}/leads.json"

ensure_data_dir() {
  mkdir -p "${DATA_DIR}"
  [[ -f "${LEADS_FILE}" ]] || echo '[]' > "${LEADS_FILE}"
}

The file is subsequently populated without enforcing restrictive permissions:

python

with open(leads_file, 'w') as f:
    json.dump(data, f, ensure_ascii=False, indent=2)

Technical Analysis

The application stores names, email addresses, companies, lead statuses, follow-up notes, scores, and deal values in ~/.leads/leads.json. Neither the data directory nor the JSON file is assigned explicit restrictive permissions.

Filesystem permissions therefore depend on the invoking user's umask. With a common umask of 022, mkdir may create ~/.leads with mode 0755, while shell redirection may create leads.json with mode 0644. On a multi-user system, these modes permit other local users to traverse the directory and read the CRM database.

The later Python writes truncate and rewrite the existing file but do not correct its permissions. This can preserve an initially permissive mode throughout the file's lifetime.

Attack Path

1. A legitimate user invokes a command such as:

   bash

   bash scripts/script.sh add "Alice Smith" "[e-mail]" "Example Corp" "website"
   

2. ensure_data_dir creates ~/.leads and ~/.leads/leads.json using permissions derived from the user's umask.
3. Under a permissive or common umask, the directory and database become accessible to other local accounts.
4. The Skill writes customer PII and commercially sensitive data into the JSON file.
5. Another local user reads the database directly:

   bash

   cat /home/victim/.leads/leads.json
   

6. The attacker obtains all CRM records stored by tha ...[truncated 674 chars]

Remediation

View remediation

Remediation Suggestions

1. Set a restrictive process umask before creating or writing CRM data:

   bash

   umask 077
   

2. Create the data directory with owner-only permissions and correct permissions on an existing directory:

   bash

   mkdir -p -m 700 "${DATA_DIR}"
   chmod 700 "${DATA_DIR}"
   

3. Create and enforce owner-only permissions on the database:

   bash

   if [[ ! -f "${LEADS_FILE}" ]]; then
     printf '%s\n' '[]' > "${LEADS_FILE}"
   fi
   chmod 600 "${LEADS_FILE}"
   

4. Write updates atomically to a temporary file created inside the protected directory with mode 0600, flush the data, and replace the destination with os.replace(). This reduces the risk of partial or corrupted writes while preserving restrictive access.

5. Before every read or write, verify that the database is a regular file owned by the current user and is not a symbolic link. Reject unsafe ownership, file types, or permissions rather than silently operating on them.

6. If the CRM data is especially sensitive, consider encryption at rest with keys stored separately in an operating-system credential facility.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documentation declares executable commands that read and write local data (~/.leads/leads.json) but does not specify any permissions or allowed-tools scope. This creates an authorization ambiguity where an agent or reviewer may not understand that file system and environment access are required, increasing the risk of overbroad execution or unintended local data exposure/modification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.