{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-31","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Introw manages partner programs alongside HubSpot or Salesforce. Review pipeline, commissions, tiers, goals, and marketing funds, and manage partner tasks or deal registrations. Actions follow your Introw permissions, with supported partner and CRM updates flowing through the CRM integration.","did":"6039e007-2be1-4e6c-8811-c2808d7c6e52","documentation_url":"https://docs.introw.io/","editorial_description":{"extended_description":"The platform supports referral, co-sell, reseller, distributor, implementation, and affiliate programs. Tools prepare business reviews, post partner-facing comments, process forms, and manage courses and view certificates. Connection uses the signed-in user's OAuth access.","schema_version":1,"summary":"Introw manages partner programs alongside HubSpot or Salesforce.\nReview pipeline, commissions, tiers, goals, and marketing funds, and manage partner tasks or deal registrations.\nActions follow your Introw permissions, with supported partner and CRM updates flowing through the CRM integration."},"homepage_url":"","icon":"https://assets.introw.io/favicon.ico","id":"6039e007-2be1-4e6c-8811-c2808d7c6e52","installs":0,"last_scanned":"","license":"","long_description":"The platform supports referral, co-sell, reseller, distributor, implementation, and affiliate programs. Tools prepare business reviews, post partner-facing comments, process forms, and manage courses and view certificates. Connection uses the signed-in user's OAuth access.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"The inventory includes adding a partner comment and submitting a partner form in a partner-management platform.","reasoning":"These operations communicate content to external partners or program operators as the user.","risk_type":"messaging_as_user","severity":"high","title":"Posts partner-visible comments and forms","triggering_tools_or_skills":["add_partner_comment","submit_partner_form"]},{"evidence":"The tools persist task, partner, CRM and training-course changes.","reasoning":"They modify meaningful partner-program records.","risk_type":"data_modification","severity":"medium","title":"Updates partners, CRM objects, tasks and courses","triggering_tools_or_skills":["create_partner_task","update_partner_task","update_partner_fields","update_crm_object_properties","upsert_course"]},{"evidence":"The declared tool creates a SCORM upload for partner training content.","reasoning":"Uploading training packages writes files into the partner-management workspace.","risk_type":"file_write","severity":"medium","title":"Creates SCORM uploads","triggering_tools_or_skills":["create_scorm_upload"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication is required; partner, CRM and form permissions are not specified.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/6039e007-2be1-4e6c-8811-c2808d7c6e52.json","what_it_proves":"Candidate PR #125 record identity (name \"Introw PRM\", publisher, type web_connector) and 22 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/6039e007-2be1-4e6c-8811-c2808d7c6e52: complete tool_names inventory (22 tools), remote streamable-http endpoint https://app.introw.io/api/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Introw can communicate through partner comments/forms and modify partner-program records.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:6039e007-2be1-4e6c-8811-c2808d7c6e52","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 22 names. Commission and marketing-funds tools only retrieve information; no payment execution or deletion is declared.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"true","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":22,"tools_or_skills_total":22},"name":"Introw PRM","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=6039e007-2be1-4e6c-8811-c2808d7c6e52&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://app.introw.io/privacy-statement","provisional_risk":null,"publication_recommendation":"accept","publisher":"Introw PRM","publisher_url":"https://introw.io/","remote_url":"https://app.introw.io/api/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: These operations communicate content to external partners or program operators as the user.","evidence":"Posts partner-visible comments and forms: The inventory includes adding a partner comment and submitting a partner form in a partner-management platform.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Posts partner-visible comments and forms","triggering_tools":["add_partner_comment","submit_partner_form"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They modify meaningful partner-program records.","evidence":"Updates partners, CRM objects, tasks and courses: The tools persist task, partner, CRM and training-course changes.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Updates partners, CRM objects, tasks and courses","triggering_tools":["create_partner_task","update_partner_task","update_partner_fields","update_crm_object_properties","upsert_course"]},{"description":"This connector can create, change, export, or otherwise write files. Review findings: Uploading training packages writes files into the partner-management workspace.","evidence":"Creates SCORM uploads: The declared tool creates a SCORM upload for partner training content.","manual_risk_type":"file_write","remediation":{"block_tool_categories":["state_change"],"steps":["Limit file access to a dedicated working directory.","Review generated or modified files before they are shared or executed."]},"risk_type":"filesystem_access","severity":"medium","title":"Creates SCORM uploads","triggering_tools":["create_scorm_upload"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@introw.io","tags":["filesystem_access","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"add_partner_comment","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These operations communicate content to external partners or program operators as the user."}},{"description":"","name":"create_partner_task","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They modify meaningful partner-program records."}},{"description":"","name":"create_scorm_upload","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, change, export, or otherwise write files. Review findings: Uploading training packages writes files into the partner-management workspace."}},{"description":"","name":"find_relevant_content"},{"description":"","name":"get_commission_information"},{"description":"","name":"get_marketing_funds_information"},{"description":"","name":"get_partner_goals"},{"description":"","name":"get_partner_tier_information"},{"description":"","name":"list_certificates"},{"description":"","name":"list_courses"},{"description":"","name":"prepare_partner_business_review"},{"description":"","name":"process_form_submission"},{"description":"","name":"search_crm_objects"},{"description":"","name":"search_form_submissions"},{"description":"","name":"search_partner_activity"},{"description":"","name":"search_partner_tasks"},{"description":"","name":"search_partners"},{"description":"","name":"submit_partner_form","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: These operations communicate content to external partners or program operators as the user."}},{"description":"","name":"update_crm_object_properties","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They modify meaningful partner-program records."}},{"description":"","name":"update_partner_fields","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They modify meaningful partner-program records."}},{"description":"","name":"update_partner_task","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They modify meaningful partner-program records."}},{"description":"","name":"upsert_course","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: They modify meaningful partner-program records."}}],"tools_count":22,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/6039e007-2be1-4e6c-8811-c2808d7c6e52","uuid":"3fbc8214-36c2-5975-873b-80daf5f69e88","verification_tier":"community","version":""},"query_key":"introw prm introw prm","schema_version":1,"status":"match"}