Salesflare CRM
v1.0.7Full Salesflare API operations skill for reading, searching, creating, and updating CRM data (accounts, contacts, opportunities, tasks, pipelines, users, tag...
⭐ 0· 117·0 current·0 all-time
byJeroen Corthout@jeroencorthout
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the actual artifacts: the repo includes discovery, request, and smoketest scripts and the declared requirement (SALESFLARE_API_KEY) plus python3 is what you'd expect for an API client. There are no unrelated credentials or binaries requested.
Instruction Scope
SKILL.md describes safe workflow (discover → read → confirm → mutate) and instructs the agent to confirm before writes. The included scripts implement discovery (fetching an OpenAPI JSON), authenticated requests, auto-pagination, and a smoketest runner. The scripts can fetch remote OpenAPI JSON or read local files (discover accepts a local path), and request helper/smoketest accept JSON bodies from files (--data-file) which will read local files and send contents to the API. This behavior is consistent with the skill's purpose but means the agent (or user) must avoid accidentally sending arbitrary local file contents to the API; SKILL.md does not explicitly warn about that specific risk. Also, sf_request/smoketest will perform many API calls (and can perform writes/deletes when explicitly enabled) — the skill docs require explicit confirmation for writes, but that is an operational rather than programmatic enforcement.
Install Mechanism
There is no install spec — instruction-only with bundled Python scripts. No remote downloads or archive extraction are performed by an installer, which minimizes install-time risk.
Credentials
Only one required env var (SALESFLARE_API_KEY) is declared and is appropriate. The code also respects SALESFLARE_BASE_URL (documented in SKILL.md) and has an internal DEFAULT_BASE which reads SALESFLARE_DEFAULT_BASE_URL — a minor inconsistency in env var naming but not a security red flag. No unrelated secrets are requested.
Persistence & Privilege
always:false and the skill does not request persistent system-wide privileges or modify other skills. The scripts do perform network calls to Salesflare API (expected). Autonomous invocation is allowed by default (platform normal) but not combined with special persistent privileges.
Assessment
This skill appears to do what it claims, but review and use caution before giving it access to real production data. Specifically:
- Only provide a SALESFLARE_API_KEY you trust; the scripts will send that key to salesflare endpoints.
- The smoketest/readers can perform writes or deletes only when explicit flags are passed, but double-check that any agent using this skill asks you for confirmation before executing POST/PUT/PATCH/DELETE or running smoketest with --allow-write/--allow-delete.
- Be careful with --data-file / data-file-like functionality: supplying a path will read that local file and send its contents to the API — avoid pointing it at sensitive local files.
- Minor env-var inconsistency: the code reads SALESFLARE_BASE_URL (documented) and also supports SALESFLARE_DEFAULT_BASE_URL internally; if you rely on custom endpoints, verify which variable to set.
- If you plan to let an autonomous agent use this skill, enforce a confirmation step in the agent policy for any write/delete operations and consider testing the scripts locally first to observe behavior.Like a lobster shell, security has layers — review code before you run it.
latestvk971vetp1p951nqvtfbkgah3vx838t1k
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📈 Clawdis
Binspython3
EnvSALESFLARE_API_KEY
Primary envSALESFLARE_API_KEY