Dangerous: builtmighty-kit - log-to-crm.py | Skillgate

Skillgate scanned .claude/hooks/log-to-crm.py in builtmighty-kit and rated it Dangerous with a risk score of 92/100 (2 detections).

Skillgate found one or more attack-shaped patterns - the kind used for credential exfiltration, remote code execution, or instruction hijack. Do not load this file into an agent without reading it end to end.

What was found

• SG-105 Hook script exfiltrates prompt/transcript to external host - CRITICAL: A Claude Code hook script (.claude/hooks/*.py|js|ts) reads hook input (prompt/transcript/tool I/O via stdin) and sends it to an external network sink. CRITICAL when hook input is read and shipped externally; MEDIUM when an external network call is present without an observed hook-input read.
• SG-037 Cleartext Secrets in Config - LOW: Cleartext secrets in env / config files

What to do

Read the flagged lines in the source file yourself before installing it or letting an agent load it. Every detection above links to the rule that fired, with the conditions that trigger it and remediation where one exists. Open the interactive report for evidence lines and context.

About Skillgate

Skillgate is a free scanner from Mitiga Labs for AI agent skills, hooks, MCP configs, and instruction files (SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules, .claude/settings.json). It runs static rules plus an LLM judge and maps each finding to a known attack technique. Static analysis only: it never executes the file it scans. No scanner is 100% accurate - a verdict is a signal, not a guarantee. Browse all detection rules.