Charmie CRM Lite

• Outcome: Review
• Latest audit: May 29, 2026 at 9:25 PM UTC
• Version:
  3.0.3

Overview

This is a local contact-management skill, but it can change or delete CRM records with broad natural-language guidance and limited safeguards.

Install only if you are comfortable letting an agent maintain a local contacts database. Use explicit commands like "in Charmie CRM, search contact..." before update or delete actions, and keep backups for any important contact data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The invocation guidance is vague and broad, using examples like "Add John Doe" and "Search for Mike" without defining strict trigger boundaries or expected parameter structure. This can cause accidental invocation or ambiguous routing, which is risky in a CRM context because user utterances containing names or contact-like phrases may trigger unintended contact creation or lookup actions.

VirusTotal

66/66 vendors flagged this skill as clean.