Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward local CSV CRM that creates and updates a workspace CRM file as part of its stated purpose.
Install only if you are comfortable keeping CRM contacts, notes, phone numbers, emails, and deal values in a plaintext workspace CSV file. Review crm.csv before bulk changes and keep backups for important customer data.
The skill instructs the agent to create and modify local files in the workspace, including creating crm.csv and updating rows, but it does not warn the user that their workspace data will be changed. This creates a risk of silent state changes, accidental overwrites, or undesired persistence of sensitive customer information.
The activation trigger is broad enough that ordinary requests about contacts, pipelines, or reminders could invoke this skill without the user clearly intending local file operations. Because the skill is stateful and writes to a workspace CSV, ambiguous activation can cause unintended reads or modifications to CRM data.
The skill is described as a local CSV-based CRM with pipeline tracking, but the README adds a callout directing users to an external website for additional products. This external promotional capability is not justified by the stated operational purpose of managing a local CRM.
No suspicious patterns detected.
