Security audit

crm-memory

Security checks for vulnerabilities and agentic risk

Overview

This CRM memory skill is purpose-aligned but needs review because it can automatically send and persist sensitive CRM data with little user control or data-handling guidance.

Install only if your organization permits CRM data to be sent to BlueColumn. Before using it, require explicit approval before each write, review the exact payload, avoid storing confidential or regulated data unless authorized, and confirm retention and deletion procedures with the provider.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:11
Finding: Automatic Transmission of CRM and Interaction Data to an External Service
Content: View full analysis
" \ -H "Content-Type: application/json" \ -d '{"text": "Deal: Acme Corp $12k ARR. Stage: negotiation. Owner: Jane. Last touch: 7/29.", "title": "crm-memory - note"}' ``` ### Technical Analysis The workflow instructs the agent to store a summary after every interaction through an externally hosted Supabase function. No instruction requires the agent to: - Obtain explicit user approval before transmission. - Preview the exact information that will be stored. - Restrict summaries to user-selected CRM fields. - Remove credentials, personal information, or unrelated conversation content. - Verify that the endpoint belongs to the intended organization or tenant. - Apply retention limits or provide a deletion mechanism. Consequently, an interaction containing confidential sales records, customer information, contractual details, or personal data may be summarized and transmitted to the external service by default. The API credential is relevant to the advertised functionality, and the destination is disclosed; therefore, the reviewed content does not establish intentional credential theft or malicious exfiltration. The security issue is the u ...[truncated 1651 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to send CRM content such as deal values, ownership, and interaction history to an external BlueColumn endpoint, but it provides no explicit warning, consent requirement, retention notice, or guidance on handling sensitive customer data. In CRM context this is especially risky because the transmitted data may include confidential commercial information and personal data, creating privacy, confidentiality, and compliance exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation description is broad enough to trigger in many ordinary CRM, sales, contact, and pipeline conversations, increasing the chance that the skill is invoked without a clear user request to use an external memory provider. In this skill, over-broad activation is more dangerous because invocation can lead to recall or storage of sensitive business and personal data through a third-party service.
Content: No source excerpt is available for this finding.

External Transmission