Real Estate Lead Pilot

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 1.0.1

Overview

This skill fits real-estate lead qualification, but it broadly logs personal lead data and behavioral scores to a CRM without clear consent or limits.

Review before installing. Use this only with a configured privacy notice and consent flow for leads, restrict CRM writes to necessary fields, avoid syncing free-form sensitive conversation content, disclose any behavioral scoring, and use authenticated least-privilege CRM/calendar integrations with retention and deletion procedures.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:21

Finding

Unconsented Personal Data Collection and Behavioral Profiling

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21-26; supporting rules in thumbgate-rules.md:9 and thumbgate-rules.md:13
Vulnerability Type: Unconsented personal-data collection, profiling, and external storage
Risk Level: Medium

Vulnerable Code

SKILL.md:21-26:

markdown

## Instructions
1. **Intake:** Greet the lead and identify if they are a Buyer, Seller, or Renter.
2. **Qualify:** Follow the 4-point qualification framework (Budget, Location, Timeline, Motivation).
3. **Verify:** Use ThumbGate rules to cross-reference their requirements with your current listings.
4. **Book:** Offer available slots from the connected calendar and confirm the appointment.
5. **Log:** Write all lead data and the "PropPhy" behavioral score to the CRM.

thumbgate-rules.md:9:

markdown

| RE-005 | CRM_CONSISTENCY | Ensure Name, Phone, and Email are captured before closing a qualification session. | Critical |

thumbgate-rules.md:13:

markdown

| RE-009 | BEHAVIOR_LOGGING | MUST log "engagement_score" (1-10) to CRM based on lead responsiveness. | Low |

Technical Analysis

The skill mandates the collection of a lead's name, phone number, and email address, derives behavioral scores from the lead's responsiveness, and directs the agent to write “all lead data” and those scores to an external CRM.

No instruction requires the agent to:

• Obtain explicit and informed consent before collection or synchronization.
• Disclose that automated behavioral profiling is taking place.
• Restrict CRM transmission to a defined allowlist of necessary fields.
• Exclude sensitive conversation content, credentials, or unrelated personal information.
• Apply retention, deletion, access-control, or data-minimization policies.
• Confirm that the CRM or webhook destination is authorized and securely configured.

The phrase “all lead data” is especially broad. Depending on the conversation ...[truncated 2150 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed consent before collecting personal information or synchronizing it with a CRM.
2. Clearly disclose automated behavioral scoring, its purpose, the factors used, and whether the score affects booking or qualification decisions.
3. Replace “all lead data” with a strict allowlist of required fields, such as name, preferred contact method, budget range, location, timeline, and appointment details.
4. Prohibit transmission of credentials, financial account information, government identifiers, legal details, free-form sensitive disclosures, and unrelated conversation content.
5. Permit users to decline behavioral profiling without unnecessarily preventing ordinary assistance.
6. Define retention periods and provide procedures for access, correction, deletion, and withdrawal of consent.
7. Require HTTPS, authenticated webhook endpoints, destination allowlisting, secret rotation, replay protection, and least-privilege CRM credentials.
8. Restrict CRM access by role and maintain auditable records of data collection, synchronization, access, and deletion.
9. Validate CRM field mappings before deployment and fail closed if the destination cannot be authenticated.
10. Add a privacy review appropriate to the jurisdictions in which the skill will operate.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states it will push lead data and behavioral scores to external CRMs, but it provides no user-facing notice, consent step, or data-handling limitation. In a real-estate lead context, this can expose sensitive personal and inferred profiling data to third-party systems without the lead's informed awareness, creating privacy, compliance, and trust risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to write all lead data and the "PropPhy" behavioral score to the CRM operationalizes broad data collection and profiling without any privacy warning or consent mechanism. This is more concerning in this context because the agent is designed for the first contact with leads, where users may reasonably not expect profiling and external storage of all provided information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The rule mandates logging an inferred "engagement_score" to the CRM, which is a form of behavioral profiling, but the file provides no requirement for user notice, consent, purpose limitation, or access controls. In a real-estate lead qualification context, this creates privacy and compliance risk because subjective scoring can influence downstream treatment of leads without transparency.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.