Security audit

Crm Next Action

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly generates reviewable CRM next-action drafts from local input, with no evidence of network exfiltration, persistence, or automatic CRM changes.

Install only if you are comfortable with a local Python helper reading the CRM/opportunity file you provide and optionally writing a report file. The publisher should remove or clearly document the unused audit modes, but the reviewed package does not show exfiltration, persistence, credential theft, or automatic CRM mutation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个面向销售/CRM 的决策辅助技能，应基于客户或机会列表逐条产出“下一步动作、跟进理由、不推进原因”。但实际代码没有任何 CRM 领域逻辑、逐条客户处理逻辑、销售建议生成逻辑，也没有针对机会池字段的专门分析。相反，它是一个由 spec 驱动的通用本地审计/报告工具，支持目录审计、CSV 字段统计、文本风险模式扫描以及 Skill 文件完整性检查。这属于 materially different primary purpose，并且实现了多项未声明的审计/扫描能力。因此描述与行为明显不符。

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code contains software and security auditing functions such as regex-based secret scanning, private URL detection, frontmatter inspection, and repository/skill structure auditing, none of which are justified by a CRM next-action skill. In this context, these features materially increase risk because they can be used to enumerate sensitive local content and mask a dual-use or deceptive capability behind an innocuous business description.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The dispatch logic implements generic file, directory, CSV, pattern, and skill-audit reporting modes instead of a CRM-specific next-action generator. This capability mismatch is dangerous because it enables the skill to inspect arbitrary local paths and produce unrelated audit output, indicating the skill may be repurposed for reconnaissance or data inspection beyond the declared sales-workflow scope.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises shell-based execution via `python3 ...` and references local files for input/output, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity where a caller or runtime may grant broader file and shell access than users expect, increasing the risk of unintended command execution or access to local data.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The file is entirely written in Chinese and includes instructions such as '使用清晰标题', but it does not indicate that language choice is optional or justified by a region-specific requirement. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This markdown file presents all user-facing headings and instructions exclusively in Chinese, including operational guidance such as waiting for user confirmation before proceeding. Under the language/locale policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The title, category label, summary, and input hint are all specified only in Chinese, indicating a fixed language/locale experience. The policy allows locale constraints only when the skill offers user choice or clearly documents a justified regional constraint, neither of which appears here.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: Multiple user-facing report strings are emitted only in Chinese, such as headings and guidance text, and similar localized output appears elsewhere in the file. This enforces a specific language/locale for all users with no opt-in or fallback, which matches the language-policy violation criteria.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The CLI presents itself as a generic local support script while exposing multiple unrelated audit workflows through user-controlled arguments and a spec-driven mode switch. This misleading interface increases the chance that operators trust and run the tool on sensitive local inputs without realizing it can inspect directories and files outside the CRM use case.

Natural-Language Policy Violations

Low

Confidence: 79% confidence
Finding: The manifest description combines Chinese and English directives but does not state whether the skill should respond in Chinese, English, or based on user preference. Under the language/locale policy rule, forcing or implicitly assuming a language without opt-in can be a policy concern.

Static analysis

No suspicious patterns detected.