Security audit

Crm Memory

Security checks for vulnerabilities and agentic risk

Overview

This CRM memory skill is not malicious, but it automatically stores and reloads sensitive customer and contact information with very broad triggers and little user control.

Install only if you want an agent to automatically build persistent local CRM records from customer conversations. Before using it with real customer data, add explicit save confirmations, review previews, deletion/retention rules, access controls, and backups for file splitting.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:21
Finding: Overbroad Automatic Persistence of Sensitive CRM Data
Content: View full analysis
- - Role: - Contact information: - Personality traits/communication preferences: - Most recent communication: YYYY-MM-DD, - Relationship assessment: ``` ```markdown ## Execution Process ### During the conversation: Identification and loading 1. Identify the customer from the conversation and fuzzily match the name against INDEX.md. 2. If an existing customer is found, read the customer file and inject key information into the current conversation context. 3. If the customer is absent from INDEX.md, mark it as a new customer and create it after the conversation. ### After the conversation: Write updates (mandatory) 1. Append newly obtained company information. 2. Add or update contact information. 3. Update opportunity and MEDDIC details. 4. Append a summar ...[truncated 3645 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.
md
--- name: crm-memory description: > 面向对象的客户记忆体系。聊起任何客户、联系人、项目机会、项目、合同、交付相关话题时激活。

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill description explicitly states it will automatically maintain files under memory/customers and write updates after conversations, but it does not warn users that their conversation content may be persisted and reused. In a CRM context this can include sensitive business and personal data, creating privacy, consent, and data-governance risks.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The activation criteria are extremely broad, including common person names, institutions, and generic business terms. This can cause the skill to trigger on ordinary conversations and then read or write CRM memory unexpectedly, increasing the chance of unauthorized persistence or disclosure of sensitive customer data.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The post-conversation workflow mandates automatic writing of new customer information, contact updates, and communication summaries into memory files. This is dangerous because sensitive or incorrect information can be persisted without review, and the user may not realize that routine conversation content is being turned into durable records.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The quality standard says qualifying conversations must be written to memory automatically without relying on user reminder, effectively enforcing unconditional retention. That removes user control and increases the likelihood that confidential customer or personal data will be stored and later surfaced in unrelated contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: 该技能整体说明、触发词与输出结构均以中文固定定义，且未说明是否支持用户选择其他语言或仅适用于特定中文业务环境。按照规则，若技能隐含强制特定语言而无用户 opt-in 或明确合理限制，应视为潜在政策问题。
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill positions itself as a foundational memory system that should retain and reuse all customer, contact, project, contract, and delivery information across dialogues. In the absence of consent boundaries, data minimization, or scope restrictions, this creates cross-session privacy risk and increases the blast radius of any accidental or unauthorized recall.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file-splitting workflow includes deleting the original customer file after restructuring, which is a destructive operation. Without warnings, backups, or transactional safeguards, an error during split/move/update could result in data loss or corrupted customer records.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description states that the skill will automatically write and update CRM memory after conversations, which is an overly broad activation and persistence behavior for customer data. In a CRM context, this can cause unintended storage of sensitive business or personal information without explicit user confirmation, increasing the risk of privacy violations, data poisoning, and accidental retention of confidential content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The manifest description is written entirely in Chinese and presents the skill's behavior in that locale without any indication that users can choose another language or that the skill is intended only for a Chinese-language context. This can violate language/locale policy when no opt-in or justification is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.