ClawHub
Back to skill

Security audit

crm-memory

Security checks for vulnerabilities and agentic risk

Overview

The skill clearly provides CRM memory, but it sends sales and customer context to an external persistent memory service without clear user consent, retention, or data-handling limits.

Before installing, confirm your organization allows CRM deal, owner, and contact context to be sent to BlueColumn. Use an approved API key, define what data may be stored, avoid secrets and regulated personal data unless explicitly authorized, and establish deletion/retention expectations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs agents to store CRM deal information, ownership details, and contact-related business context in an external persistent memory service, but provides no warning, consent guidance, data-classification limits, retention controls, or handling requirements for sensitive customer data. In a CRM context, this increases the risk of unauthorized disclosure of personal data, confidential sales information, and regulated customer records, especially because the workflow normalizes automatic recall and post-interaction storage.

Static analysis

No suspicious patterns detected.