Security audit
Security checks for vulnerabilities and agentic risk
This sales assistant needs review because broad conversation triggers can initiate cloud setup and recurring tasks without clear user approval.
Require explicit approval for the Feishu account, resource creation, and each recurring job; leave the unrelated news digest disabled. Establish how to remove scheduled jobs. Import only authorized customer data, minimize identifying details, verify sharing permissions, and redact customer screenshots before posting. All eight artifact files were inspected; connected-account permissions and actual scheduling behavior were not tested.
The supplied code only discovers published skills. It does not create Feishu resources or perform any of the declared sales management functions. No connection is shown that would make this search a supporting implementation step for those functions. This assessment is limited to the supplied chunk; it does not establish what other, unseen code might do.
The supplied commands invoke scripts.run_loop with an evaluation dataset and a skill path. This is a development/testing operation, not an implementation step that directly provides the described sales-management functions. The chunk contains no Feishu provisioning, customer follow-up, task delivery, deal tracking, or reporting behavior. The assessment is limited to the supplied code; the internal behavior of the invoked Python module is not shown.
普通安装步骤可以视为支持性实现细节，不应单独判为不匹配。但此代码片段还包含向 ClawHub 发布技能的命令，涉及声明之外的对外分发操作，且整体内容是技能部署与分发流程，并未实现声明的销售管理功能。结论仅针对所提供的代码片段，不代表未提供的技能代码一定缺少相关功能。
The supplied chunk concerns ClawHub authentication rather than insurance sales management or Feishu provisioning. No connection is shown that would establish these commands as supporting implementation details of the declared workflow. This assessment is limited to the supplied chunk; it does not establish what the rest of the skill does.
The chunk is a publishing guide rather than an implementation of the declared sales-management workflow. If executed, its commands authenticate to ClawHub and publish the skill package, neither of which is disclosed in the description or needed to create the stated Feishu sales-management resources. The supplied chunk contains no implementation of those declared features.
The supplied command targets ClawHub authentication rather than the declared Feishu-based sales-management functionality. No connection is shown that would make this login a supporting implementation detail of the stated workflow. This assessment is limited to the supplied snippet; it does not establish credential theft or other malicious behavior.
The only supplied command performs skill publication, which is a distribution operation rather than an implementation of the declared sales-management features. No Feishu provisioning, customer management, task delivery, or reporting behavior appears in this chunk. This assessment is limited to the supplied README snippet; it does not establish what other files in the skill might implement.
The supplied commands perform package publication rather than insurance sales management or Feishu setup. Publication is a separate distribution action, not an implementation step for the described user workflow. This assessment applies only to the supplied publishing guide; it does not establish what the rest of the skill implements or whether these commands execute automatically.
The supplied commands perform marketplace lookups, not the declared Feishu setup or sales-workflow functions. Although the filename suggests a publishing or maintenance guide, the executable behavior shown has a materially different immediate purpose. This assessment is limited to the supplied chunk and does not establish what the rest of the skill implements.
The observed action concerns ClawHub authentication rather than the declared Feishu-based sales assistant. Although the filename suggests a publishing guide, the description does not establish ClawHub login as part of the user-facing workflow. This assessment is limited to the supplied command; it does not imply credential theft or other unobserved behavior.
The README connects a vague first mention of related functionality to automatic creation of external Feishu resources and local configuration, without a confirmation step. This can turn an informational or unrelated request into unintended state-changing operations under the user's connected account.
The onboarding workflow requests identifiable customer names, WeChat identifiers, relationship status, and needs for cloud storage and assistant processing without explaining the privacy implications or checking authorization. Insurance-related customer information makes this omission more consequential; private-by-default resources do not establish permission to process third-party data.
The onboarding instructions direct users to submit a populated customer template for assistant-mediated import without a privacy or authorization checkpoint. The accompanying customer fields associate identities with insurance interests, so the workflow can encourage unauthorized third-party data processing even if the destination tables are private.
Generic mentions such as social posts or reviews can select this skill even when the user is not requesting an insurance CRM. Because first activation directs automatic external resource creation and subsequent automation setup, an overbroad trigger can cross from relevance misclassification into unauthorized side effects.
The template solicits customer identities, WeChat identifiers, insurance needs, and free-text notes, then directs users to share the document for bulk import without a privacy or authorization checkpoint. Encouraging broad collection, including referrals not yet contacted, increases the chance of processing third-party information without appropriate authorization.
The template recommends posting customer chat screenshots to a social feed, while the redaction instruction explicitly applies only to the alternative claim-notification screenshot. In an insurance context, chats may expose customer identities, medical conditions, claim details, or financial information, making this an unsafe disclosure recommendation even though no actual disclosure is shown.
The skill includes a daily AI-news digest in its execution schedule and cron configuration even though that activity is outside its declared insurance-sales purpose. Combined with automatic configuration instructions, this can introduce an unrequested persistent task, causing unwanted notifications and resource consumption.
