CRM in a Box (Hybrid Labs)

Bootstrap and manage an open, file-based CRM using the CRM-in-a-Box protocol (contacts, pipeline, interactions as NDJSON). Use when setting up a new CRM for...

Security Scan

The skill is internally coherent for a local, file-based CRM: it reads/writes NDJSON files under a per-user directory and asks for no credentials or external installs, though some marketing claims (hash‑chaining/cryptographic links) are not implemented in the shipped code.

Purpose & Capability

The name/description promise an open, file-based CRM — and the code and SKILL.md implement a simple file-based NDJSON CRM CLI that creates and manipulates contacts, pipeline, and interactions. However, README/SKILL.md/landing text claim 'hash-chained' / 'cryptographically linked' entries and tamper-evidence; crm_cli.py does not implement hashing, signature, or git integration, which is a mismatch between advertised features and delivered capability.

Instruction Scope

Runtime instructions and the CLI operate only on local files (contacts.ndjson, pipeline.ndjson, interactions.ndjson, config.yaml). The SKILL.md instructs simple shell/file commands (copy, grep, cat) and JSON formatting; there are no instructions to read unrelated system files, call external endpoints, or exfiltrate data.

Install Mechanism

No install spec is provided (instruction-only skill). A Python CLI file is included but nothing in the metadata installs additional packages or downloads from external URLs. This is low risk from an install mechanism perspective.

Credentials

The skill requires no environment variables, no credentials, and no config paths beyond creating/using a directory in the user's home. The default directory (~/.openclaw/workspace/crm) is reasonable for user-scoped data, though notable.

Persistence & Privilege

always is false and the skill does not request persistent platform privileges. It writes only to its own CRM directory under the user's home and does not modify other skills or system-wide configuration.

Assessment

This skill appears to be a straightforward, local file-based CRM and does not request credentials or network access. Before installing: (1) be aware the README/marketing mentions 'hash‑chained' and tamper‑evidence but the included crm_cli.py does not implement cryptographic linking — if you need tamper‑evidence, review or extend the code to add hashing or git signing; (2) note the default storage path ~/.openclaw/workspace/crm — you may want to initialize a CRM in a different directory or sandbox it; (3) inspect the full crm_cli.py (and any truncated portions) yourself to confirm there are no network calls or unexpected behavior; and (4) run it in a local/sandbox environment and keep backups (or put the CRM under your own git control) before using with real contact data.

CRM-in-a-Box Skill

An open, agent-native CRM protocol. One directory = one CRM. No vendor lock-in.

Files

• contacts.ndjson — one JSON object per line, each a contact/company record
• pipeline.ndjson — deal/opportunity tracking with stages
• interactions.ndjson — append-only log of emails, calls, notes, meetings
• config.yaml — pipeline stages and labels

Bootstrap a New CRM

Copy the baseline files into a company directory:

mkdir -p ./mycompany/crm
cp /path/to/crm-in-a-box/{config.yaml,contacts.ndjson,pipeline.ndjson,interactions.ndjson} ./mycompany/crm/

Or start fresh with empty NDJSON files and the default config.

Contact Schema

{
  "id": "c001",
  "name": "Jane Smith",
  "email": "[e-mail]",
  "company": "Acme Corp",
  "phone": "[phone]",
  "stage": "new",
  "labels": ["hot-lead"],
  "notes": "Referred by John.",
  "created_at": "2026-01-01T00:00:00Z"
}

Pipeline Schema

{
  "id": "p001",
  "contact_id": "c001",
  "stage": "proposal_sent",
  "deal": "Enterprise License",
  "value": 12000,
  "updated_at": "2026-01-15T00:00:00Z"
}

Interaction Schema

{
  "id": "i001",
  "contact_id": "c001",
  "type": "email",
  "summary": "Sent intro email about Denver market sale.",
  "at": "2026-01-15T10:00:00Z"
}

Pipeline Stages (default)

new → contacted → meeting_scheduled → proposal_sent → negotiating → won / lost

Default Labels

hot-lead, warm-lead, cold-lead, referral, conference, inbound, outbound

Agent Instructions

• Log a contact: append a JSON line to contacts.ndjson
• Update a stage: append an updated entry to pipeline.ndjson (keep old entries — append-only)
• Log an interaction: append to interactions.ndjson
• Search contacts: grep -i "name" contacts.ndjson | python3 -m json.tool
• List pipeline: cat pipeline.ndjson | python3 -c "import sys,json; [print(json.dumps(json.loads(l), indent=2)) for l in sys.stdin]"

Forks / Verticals

Fork config.yaml to customize stages and labels for your vertical:

• pm-crm — Property management (tenants, owners, vendors)
• saas-crm — SaaS sales
• realestate-crm — Buyers, sellers, listings
• recruiting-crm — Candidates, jobs, placements

---

Part of the biz-in-a-box family of open protocols.