activecampaign
3 findings (1 high, 2 medium), mainly data exfiltration, unauthorized tool use. Most recent scan 2026-02-05.
This ActiveCampaign CRM integration skill presents MEDIUM-HIGH security risks primarily related to credential management and missing implementation files. The most critical issue is the recommendation to store API credentials in plaintext files without encryption, which could expose full CRM access if the filesystem is compromised. The skill references an 'activecampaign' binary throughout but provides no implementation, creating a tool shadowing vulnerability where malicious executables could intercept credentials. Additional concerns include environment variable credential exposure, missing reference files (sample.py, config.py), and lack of metadata (license, compatibility, allowed-tools). While the skill's stated purpose (CRM integration) is legitimate, the implementation approach requires significant security hardening before production use with sensitive customer data.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco rates this HIGH and SkillSpector found nothing. Check the false-positive register; signature matches on documentation are the usual cause. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
ActiveCampaign CRM integration for lead management, deal tracking, and email automation. Use for syncing demo leads, managing clinic sales pipeline, and triggering follow-up sequences.
- Package
- 3 files, 12 KB
- SKILL.md
- 455 words, 12+ sections
- Code
- None. Instructions only.
- Requires
- bins:
activecampaign; env:ACTIVECAMPAIGN_URLACTIVECAMPAIGN_API_KEY
SKILL.md covers: ActiveCampaign Skill 📧 · Purpose · Setup · 1. Credentials · Create config directory · Add credentials · Or use environment variables · 2. Custom Fields Configuration (Optional) · Initialize config from sample · Edit with your field IDs · Usage · Contacts
Findings
HIGH Hardcoded API Credentials in Configuration Files Data Exfiltrationllm
The skill instructs users to store ActiveCampaign API credentials (URL and API key) in plaintext files (~/.config/activecampaign/url and ~/.config/activecampaign/api_key) without encryption or secure storage mechanisms. API keys provide full access to the ActiveCampaign account including contact data, deals, and automation triggers. Storing credentials in plaintext files poses a significant data exposure risk if the filesystem is compromised.
SKILL.md
```bash
# Add credentials
echo "https://youraccount.api-us1.com" > ~/.config/activecampaign/url
echo "your-api-key" > ~/.config/activecampaign/api_key
```MEDIUM Missing Executable Implementation Creates Tool Shadowing Risk Unauthorized Tool Usellm
The skill references an 'activecampaign' binary/executable throughout the instructions (e.g., 'activecampaign contacts list', 'activecampaign deals create') but no script files are provided in the package. This creates a tool shadowing vulnerability where a malicious actor could place a fake 'activecampaign' executable in the user's PATH that intercepts all commands and credentials. The skill's reliance on an external, unverified binary without bundling the implementation or verifying its integrity poses a supply chain risk.
SKILL.md
Multiple command examples reference 'activecampaign' binary:
```bash
activecampaign contacts list
activecampaign contacts create "email@test.com" "First" "Last"
activecampaign deals list
```
But no Python/Bash scripts are included in the package.MEDIUM Environment Variable Credential Exposure Risk Data Exfiltrationllm
The skill recommends storing API credentials in environment variables (ACTIVECAMPAIGN_URL, ACTIVECAMPAIGN_API_KEY) which can be exposed through process listings, logs, error messages, and child processes. Environment variables are visible to all processes running under the same user and may be logged by shells, applications, or monitoring tools. This creates multiple vectors for credential leakage.
SKILL.md
```bash
# Or use environment variables
export ACTIVECAMPAIGN_URL="https://youraccount.api-us1.com"
export ACTIVECAMPAIGN_API_KEY="your-api-key"
```What is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 2.3 KB |
SKILL.md | doc | 4.0 KB |
activecampaign-fields-sample.json | config | 5.5 KB |
External hosts referenced
youraccount.api-us1.com github.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Scan history
| Date | Verdict | Findings | Change | Analyzers | Raw |
|---|---|---|---|---|---|
| HIGH | 3 | = | static behavioral llm trigger meta | JSON | |
| CRITICAL | 3 | first scan | static behavioral llm trigger meta | JSON |
Sources
- Repository: https://clawhub.ai/skills/babyconnect
- Raw scan result: baby-connect-logger-scan.json
- Badge for your README:
- Request a re-scan