Security audit
Security checks for vulnerabilities and agentic risk
This is a local CRM skill that stores drafts and confirmed activity or task records in SQLite, with some documentation quality issues but no evidence of exfiltration, deception, or unsafe persistence.
Install only if you are comfortable with a local SQLite CRM database retaining draft content, including rejected drafts. Pay attention to the exact confirmation words `记` and `不记`, and treat the family/personal prefixes as additional local profile routing even though the main instructions do not explain them well.
The README includes suspicious non-ASCII control or mixed-script content, most visibly around the trigger tokens shown as 记 / 不记. Hidden or mixed-script characters can mislead reviewers about the actual required commands, create ambiguity between displayed and parsed text, and conceal behavior that differs from what a user expects.
The README states that writes occur only after specific Chinese trigger terms, but it offers no language choice, opt-in, or equivalent defaults for other users. Requiring obscure non-default trigger phrases can weaken informed consent, make confirmations hard to recognize or audit, and increase the chance of accidental or misunderstood state-changing actions in a security-sensitive workflow.
The class is named WorkCRMEngine and its docstring describes a generic intent-to-write flow without disclosing that the engine can target a separate family repository. The implementation immediately supports a repo mapping with work and family profiles, which changes the operational scope beyond what the class-level documentation suggests.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
The test hard-codes the natural-language cancel phrase "不记" and elsewhere confirms with "记", implying the skill may require Chinese-language inputs for critical confirmation behavior. This can violate language/locale policy if users are not given a choice or if the locale restriction is not clearly justified.
The inline comment documents support for work and family repositories, but the routing prefixes include 个人: in addition to family-oriented prefixes. This means the documented intent of profile handling is narrower than the actual accepted command space.
The intent classifier embeds specific Chinese trigger terms in addition to English terms, which creates language-dependent behavior in skill activation. Because the file provides no natural-language explanation, opt-in, or locale selection mechanism, this can be interpreted as an undocumented language policy choice.
No suspicious patterns detected.
