Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward local CSV CRM manager; it can change local contact records, but that behavior is disclosed and aligned with its purpose.
Install only if you are comfortable storing customer, contact, and deal information in a plaintext crm.csv file in the workspace. Keep the workspace private, review changes before broad updates, and avoid using shared or cloud-synced folders for sensitive CRM data.
The skill describes managing a local CSV CRM but does not prominently warn users that it may create, update, and back up local workspace files. In a file-writing skill, missing disclosure increases the chance of users unknowingly authorizing modifications to sensitive business contact data, which can cause integrity and privacy issues if the wrong file is edited.
The command patterns are broad enough that many ordinary CRM-related requests could activate the skill and cause it to read or modify a local crm.csv file. Because the skill is state-changing and operates on local data, accidental invocation can lead to unintended record creation or updates, especially when the user intended analysis or discussion rather than file mutation.
The README explicitly promotes managing contacts and deals in a local CSV file but does not warn users that potentially sensitive customer and sales data will be stored unencrypted on disk. This can lead to unintentional exposure of personal or business-sensitive information, especially on shared machines, synced folders, or poorly secured endpoints.
No suspicious patterns detected.
