Sales Rhythm Tracker — Alibaba Iron Army B2B Pipeline

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:37 PM UTC
• Version: 1.0.0

Overview

This local sales CRM skill is coherent, but it needs Review because it stores customer deal data and later feeds raw CRM records into agent instructions.

Install only if you are comfortable keeping sales and customer notes in local markdown files and having the agent read full pipeline records for reports. Avoid putting untrusted customer-provided text directly into notes, review pipeline files for embedded instructions, and prefer confirming any write, cron, or follow-up action before the agent performs it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/morning-brief.sh:43
• Finding: Untrusted CRM Content Is Embedded in Agent Instructions Without Isolation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/add-lead.sh:22-35`; `scripts/log-activity.sh:24-32`; `scripts/morning-brief.sh:43-59`; `scripts/pipeline-health.sh:20-30`; `scripts/weekly-sprint.sh:31-38` **Vulnerability Type**: Indirect prompt injection through persisted CRM content **Risk Level**: High ### Vulnerable Code `scripts/add-lead.sh:22-35` persists user-controlled lead fields without validation, escaping, or structural isolation: ```bash cat >> "$PIPELINE" << EOF ### ${NAME} @ ${COMPANY} - **Stage**: ${STAGE} - **Type**: Unknown — detect on next interaction (look for Tiger/Peacock/Koala/Owl signals) - **Score**: 45 - **Status**: 🟢 Green - **Deal Size**: ${DEAL_SIZE} - **Last Contact**: ${TODAY} - **Next Action**: Schedule discovery call within 48 hours — prepare 3 open questions about their pain - **Key Pain**: To be discovered - **Notes**: ${NOTES} EOF ``` `scripts/log-activity.sh:24-32` similarly persists untrusted activity content: ```bash cat >> "$ACTIVITY_LOG" << EOF ## ${TODAY} ${TIME} — ${CUSTOMER} @ ${COMPANY} - **Activity**: ${ACTIVITY} - **Summary**: ${SUMMARY} - **Next step**: ${NEXT_STEP} - **Logged**: $(date) EOF ``` `scripts/morning-brief.sh:43-59` prints the resulting file directly into a prompt-like output immediately before Agent instructions: ```bash echo "📋 PIPELINE DATA:" echo "" cat "$PIPELINE" echo "" echo "---" echo "" echo "💡 AGENT INSTRUCTIONS:" echo "Based on the pipeline above, please:" echo "1. Identify all leads with Last Contact > 7 days → flag 🔴 Red" echo "2. Identify leads in 'closing' or 'negotiation' stage → top priority" echo "3. For each priority lead, check their Type (Tiger/Peacock/Koala/Owl)" echo " and suggest the right approach script" echo "4. List top 3-5 actions for today, ordered by urgency score" echo "5. Identify which leads to SEED today (new outreach)" echo "6. End with: total active leads, deals at risk, and one this-week close target" echo "" echo "Format output as t ...[truncated 3398 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Use structured storage** - Store CRM records in JSON or another structured format. - Validate every record against a strict schema before persistence. - Define fixed enumerations for stage, activity type, customer type, and status. - Enforce maximum lengths and reject unexpected object properties. 2. **Constrain untrusted text fields** - Reject or normalize control characters. - Disallow multiline values where they are unnecessary. - Apply reasonable length limits to names, notes, summaries, and next steps. - Do not rely on Markdown escaping alone as a prompt-injection defense. 3. **Separate data from Agent instructions** - Pass CRM records through a dedicated data channel or structured tool result rather than concatenating them into an instruction prompt. - If textual composition is unavoidable, place records inside explicit delimiters and state before them that all enclosed content is untrusted data. - Explicitly instruct the Agent never to follow commands, tool requests, role changes, or policy statements found inside CRM records. 4. **Apply least privilege** - Run report-generation tasks with only the file access required for the sales workspace. - Do not grant network, credential, shell, messaging, or unrelated workspace access unless needed for the requested operation. - Require confirmation before consequential tool actions initiated from generated reports. 5. **Handle existing data safely** - Inspect existing `pipeline.md` and `activity-log.md` files for embedded instructions. - Migrate valid records into the validated structured format. - Quarantine records that fail schema or content validation. 6. **Add security tests** - Test multiline fields that contain fake headings such as `AGENT INSTRUCTIONS`. - Test requests to ignore prior instructions, access unrelated files, invoke tools, or disclose secrets. - Verify that such strings remain inert report ...[truncated 41 chars]

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The listed trigger phrases are broad, natural-language commands such as "follow up," "sales update," and "close rate" that can plausibly appear in ordinary conversation. If the agent uses loose phrase matching, the skill could activate unintentionally, causing it to read or modify local sales pipeline files or produce sensitive business summaries without the user explicitly intending to invoke the skill.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The phrase "sales update" is generic and can easily occur in routine team conversations, status reports, or forwarded messages. This raises the risk of unintended skill activation, which can lead to unauthorized reads of pipeline state or unwanted writes to CRM files if the agent interprets surrounding text as commands.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrase "follow up" is very broad and appears in ordinary workplace conversation, making accidental invocation plausible in chat environments. Unintended activation could expose or modify locally stored sales data, generate actions the user did not request, or cause confusing agent behavior during unrelated discussions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Although the file later mentions local storage, the command-oriented description does not clearly warn users at the point of use that customer names, interactions, and deal notes are persistently written to local workspace files. Users may disclose sensitive customer or sales information without understanding retention, creating privacy, compliance, and data-handling risks.

Session Persistence

Medium

• Category: Rogue Agent

Content

> "New lead: [Name] at [Company] — [context]"
> Example: "New lead: David Park at Sunrise Manufacturing — met at trade show, interested in reducing procurement costs"

Agent will: Create lead profile → Classify personality type from context → Set stage to connected → Add to next morning brief.

**Check Deal Status**:
> "How is [customer name] doing?" / "Update on [company]"

• Confidence: 80% confidence
• Finding: The skill persists detailed customer and activity information across sessions, including inferred personality classifications and follow-up history. Persistent storage is not inherently unsafe, but in a sales context it can accumulate sensitive business and personal data that may be accessed later without adequate user awareness, minimization, or retention controls.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The user-facing output includes Chinese-only labels such as "挖需求" and "提成交" in the printed guidance, but the script does not offer a language selection or indicate that Chinese output is required for a region-specific use case. This can violate language/locale policy by forcing a specific language presentation on users without consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script unconditionally prints the entire sales pipeline to stdout, which can expose sensitive business information such as leads, deal stages, customer notes, and strategy to anyone with terminal access, logs, or captured agent output. In an agent skill context, this is more dangerous because the content is explicitly intended to be consumed by another system or model, increasing the chance of unintended disclosure beyond the local user.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: Phase names include Chinese text in parentheses, such as `播种`, `翻牌`, `采果`, and `机动`, while the rest of the script is in English. This imposes mixed-language output without any opt-in or explanation, which can violate language or locale policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: This markdown file includes the phrase "挖需求" in otherwise English-language operating guidance. Under the policy, forcing or introducing a specific language without opt-in can be a locale/language policy issue when no choice or justification is provided.

Static analysis

No suspicious patterns detected.