ClawHub
Back to skill

Security audit

Personal Crm

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real personal CRM skill, but it needs review because it can automatically save sensitive relationship details from casual conversation and bulk-import phone contacts without strong consent boundaries.

Install only if you are comfortable with an agent saving personal and third-party relationship details to your Feishu/Lark Bitable. Use explicit save/import commands where possible, review records before syncing phone contacts or exporting, protect the Feishu credentials in local config, and avoid enabling the cron reminder unless you want recurring CRM access.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly promotes automatic capture from ordinary conversation such as mentioning a person or recounting a social interaction, without defining clear trigger boundaries or requiring explicit confirmation before storing data. In a personal CRM context, this can cause over-collection of highly sensitive relationship data, including third-party personal details, and may lead users to unknowingly persist private conversations into Feishu/Lark records.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The feature list emphasizes natural-language automatic recording of contacts, stories, preferences, birthdays, and follow-ups, but does not warn users that casual conversation may be transformed into stored personal relationship data. This is dangerous because users may disclose sensitive information about themselves or others without realizing it will be retained, creating privacy, consent, and compliance risks in a system designed to store long-term personal profiles.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation rules are broad enough to trigger on ordinary conversation about acquaintances, birthdays, meetings, or life events. In a skill designed to store personal relationship data, this can cause unintended collection and persistence of sensitive personal information without a deliberate invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly instructs the agent to proactively capture and store personal stories, preferences, and contact details mentioned casually, without an explicit privacy warning or save confirmation. Because the stored data includes sensitive relationship and behavioral information, silent collection meaningfully increases privacy and consent risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

ADB-based phone contact extraction is a major capability expansion beyond a Feishu-backed personal CRM: it reaches into a connected device and reads highly sensitive contact data. If triggered improperly or used in a shared environment, it could harvest large volumes of personal data unrelated to the immediate task.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The phone-contact sync feature accesses sensitive device data but does not provide a prominent warning about the volume and sensitivity of the data being read or how it will be stored. Users may not appreciate that a single command can ingest an entire address book into the CRM.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The setup guide instructs users to place a Feishu/Lark app token directly into a local JSON config file, but gives no guidance on file permissions, secret storage, or rotation. Even though this is documentation rather than executable code, it normalizes unsafe credential handling and can lead to token exposure through backups, screenshots, shell history, dotfile sync, or multi-user systems.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SETUP.md (reported line 79)May include surrounding context.

Step 5: Set Up Daily Reminders (Optional)

Create a cron job for birthday/anniversary/contact reminders:

bash
openclaw cron add \

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill describes capabilities that imply access to environment/config secrets, local files, and networked Feishu APIs, but it does not declare an explicit tool scope such as allowed-tools or permissions. That mismatch weakens least-privilege controls and makes it easier for the agent runtime to grant broader access than users would expect for a CRM skill handling sensitive personal data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Generic setup/import triggers like '设置 CRM' or broad '导入联系人' phrasing are likely to collide with unrelated tasks and cause the wrong skill behavior to activate. In this context, accidental activation can lead directly to data creation, import workflows, or requests for sensitive credentials and table IDs.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill tells the agent to save personal details from casual conversation even when the user did not explicitly ask to store anything. This undermines user consent and can create hidden records containing sensitive third-party information that was only mentioned conversationally.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow directs automatic creation of interaction records and note updates based on narrated conversations, again without explicit authorization at the moment of storage. This can persist sensitive facts, relationship context, and inferred metadata that the user may have intended only as transient chat context.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The general rule to proactively update contact records whenever new information appears in conversation authorizes silent background data mutation. In a CRM holding sensitive personal profiles, this can lead to inaccurate, over-collected, or nonconsensual records being accumulated over time.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The import flow instructs execution of local Python scripts and shell-style commands using user-supplied file paths. Even without obvious injection syntax in the documentation, introducing command execution for routine imports increases the risk of unsafe path handling, unexpected local file access, and privilege misuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The OCR workflow expands the skill from Feishu CRM management into local image processing and shell command execution with tesseract. This broadens the attack surface and can expose sensitive images or filesystem paths, especially because the manifest does not clearly scope or justify this extra capability.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
84% confidence
Finding

The documentation includes a sudo-based package installation command, which normalizes privileged system modification as part of routine skill use. Encouraging root-level commands increases the risk of unsafe environment changes and is unnecessary for many managed or sandboxed agent deployments.

Content

Scanner excerpt · SKILL.md (reported line 366)May include surrounding context.

注意： 需要先安装 tesseract-ocr：

bash
sudo apt install tesseract-ocr tesseract-ocr-chi-sim

8.4 手机联系人同步（ADB）

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The export feature writes a sensitive contact database to local files without warning about data-at-rest exposure, backup retention, or shared-machine risks. For a personal CRM containing birthdays, notes, and relationship history, silent local export materially increases the chance of accidental disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language instructions that force a specific language for usage, configuration guidance, and output. Under the language/locale policy, that is a violation unless the skill offers user opt-in or clearly states a justified region-specific scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.