Security audit

Client Relationship Manager

Security checks for vulnerabilities and agentic risk

Overview

This CRM skill is mostly coherent, but it includes optional recurring automation that can repeatedly send sensitive CRM summaries to external services and gives weak guidance around client credentials.

Review this skill before installing if your CRM data is confidential. Avoid enabling the weekly Telegram cron unless external model processing and Telegram delivery are approved for your client data, and do not place passwords, API keys, or login secrets in the CRM markdown files; use a password manager or approved secret-sharing process instead.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

Location: SKILL.md:225
Finding: Recurring External Disclosure of CRM Data Through a Persistent Scheduled Task
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The onboarding checklist explicitly includes collecting client access credentials, but provides no guidance on secure handling, storage, transmission, or least-privilege practices. In a text-file CRM skill, this can normalize placing secrets in plain markdown or adjacent notes, increasing the risk of credential leakage, reuse exposure, or unauthorized access if the repository, device, or agent context is compromised.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:144