CRM

• Outcome: Review
• Latest audit: Jul 27, 2026 · 8:54 AM UTC
• Version: 1.0.2

Overview

The CRM skill is coherent and local-only, but it gives an agent broad authority to change and sometimes delete shared CRM/contact records without consistently requiring explicit confirmation.

Install only if you want the agent to maintain local CRM and shared contact files for you. Before using it on real customer or relationship data, set a strict safety posture: require confirmation for deletes, merges, imports, migrations, shared-contact edits, and file splits; prefer archive over hard delete; keep backups; and avoid inbox sync unless you have authorization and clear retention rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The instruction to 'delete removed people from the shared ~/Clawic/data/contacts/contacts.md' crosses the stated scope boundary of the CRM skill and directs modification of a separate shared address-book dataset. Because this is a destructive action against another system of record and is embedded in routine hygiene guidance, an agent could remove legitimate contacts without explicit user confirmation or clear ownership checks.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The instruction to copy imported CRM people into a shared contacts dataset crosses the skill's stated boundary and increases the spread of personal data into another repository. That makes access control, deletion handling, and purpose limitation harder, and can cause CRM imports to silently become address-book data replication.

Intent-Code Divergence

Medium

• Confidence: 79% confidence
• Finding: The document correctly warns against importing purchased lists without lawful-basis checks, but later broad instructions to route imported people into shared contacts storage weaken that safeguard by normalizing downstream duplication of personal data. In practice, once data is copied into a shared store, unlawful or restricted records may persist beyond the original CRM workflow and be harder to identify and purge.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guidance says to 'Delete or archive the rest from view' while reviving a CRM, but it does not explicitly warn about verifying backups, exportability, retention obligations, or recovery before removing records from the active view. In a CRM context this can lead users to perform destructive cleanup on customer/contact data, potentially causing irreversible loss, compliance issues, or accidental removal of records needed for sales, donor, or unsubscribe/do-not-contact workflows.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file explicitly describes inbox sync as ingesting personal mail that users did not consent to store, but it still presents the option as part of the logging hierarchy rather than prohibiting or strongly gating it. In a CRM skill, this is especially risky because it can normalize bulk collection of sensitive third-party communications into business records, creating privacy, consent, and data-minimization violations.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This guidance includes an unqualified destructive operation—deleting people from a shared contacts file—without an inline warning, confirmation requirement, or rollback/export step tied to that specific action. In an agent skill, that omission is dangerous because the deletion may be executed as part of a normal monthly sweep, causing silent data loss outside the CRM's intended domain.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs moving data from legacy paths and implies modifying user files automatically, but it does not require explicit user confirmation before performing potentially destructive file operations. In a memory-management skill, path migration can overwrite, relocate, or break user workflows if done incorrectly, especially when older directories may still be in active use.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The phrase 'No permission needed' authorizes autonomous writes and deletions, removing an important safety boundary for file modification. In a skill that operates over persistent CRM records and shared files, this can cause unintended alteration or deletion of user data without a deliberate approval step.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The split procedure mandates deleting content from `memory.md` after moving it, without requiring backup verification or user approval. If the copy step is partial, malformed, or written to the wrong location, the original content is lost, making this a real integrity and availability risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The file explicitly instructs the user to record and maintain personal relationship data across several local files, including contacts, interaction history, pipeline state, and recurring reminders, but the cited section does not include any immediate warning about handling personal data safely. In a CRM skill, this creates a realistic privacy risk because users may store sensitive personal or professional details, and the operational emphasis on comprehensive logging can normalize collecting more data than necessary.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The skill explicitly instructs the agent to write persistent data into a local memory file under ~/Clawic/data/crm/memory.md after making a tool decision. That modifies user state without any embedded safeguard such as requiring confirmation, validating that the path is within an approved workspace, or warning that the action persists data, which can lead to unintended overwrites or accumulation of sensitive CRM notes.

Session Persistence

Medium

• Category: Rogue Agent

Content

Everything except interactions, closed deals, the suppression list, artifacts, `db/` and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/crm/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

• Confidence: 90% confidence
• Finding: create the new file in `~/Clawic/data/crm/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file. 3. Keep the

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.