Twenty CRM

Interact with Twenty CRM (self-hosted) via REST/GraphQL.

Security Scan

The skill's scripts do what the description says (call a self-hosted Twenty CRM via REST/GraphQL), but there are clear mismatches around configuration and required credentials that could cause failures or accidental exposure of secrets.

Purpose & Capability

The scripts match the stated purpose (curl + GraphQL/REST helpers). However the skill does not declare the credentials it actually needs (TWENTY_BASE_URL, TWENTY_API_KEY) and the runtime config path is hardcoded to a developer-specific absolute path (/Users/jhumanj/clawd/config/twenty.env) rather than the relative config/twenty.env referenced in SKILL.md. This mismatch is incoherent and not proportional to the stated purpose.

Instruction Scope

SKILL.md instructs the user to create config/twenty.env (relative), but the runtime loader (scripts/twenty-config.sh) reads /Users/jhumanj/clawd/config/twenty.env. The scripts otherwise stay within scope (they only call the target TWENTY_BASE_URL endpoints using curl and call python3 locally). There is no obvious exfiltration to other endpoints, but the absolute config path means the skill may read an unexpected file on the host if present.

Install Mechanism

There is no install spec — this is instruction/script-only. Nothing is downloaded or extracted from the network by the skill itself. Scripts rely on common tools (bash, curl, python3) but no package installation is performed by the skill bundle.

Credentials

The skill requires sensitive data (TWENTY_API_KEY and TWENTY_BASE_URL) but does not declare any required environment variables in its metadata. Instead it expects those values to be present in a config file at an absolute path. Not declaring the credential requirements is a mismatch and increases the risk of misconfiguration or accidental exposure of secrets.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or global agent settings, and does not require persistent system-level installation. It runs only when invoked.

What to consider before installing

Key points to consider before installing or using this skill: - Don’t assume the SKILL.md path is authoritative: the scripts actually try to load /Users/jhumanj/clawd/config/twenty.env. That is a hardcoded developer path and is inconsistent with SKILL.md (which says create config/twenty.env). Ask the author to fix the config path (make it relative or respect an env var) before using. - Secrets are required but not declared: the scripts need TWENTY_BASE_URL and TWENTY_API_KEY. Keep that API key secret and avoid placing it in world-readable files. Prefer exporting them as environment variables or placing the config file in a secure location you control. - Verify destination of requests: the scripts send the API key in an Authorization header to whatever TWENTY_BASE_URL you configure. Ensure that URL is your intended self-hosted instance (not a public or attacker-controlled endpoint). - Operational notes: these scripts call curl and python3 and write one temporary JSON file to /tmp. They do not install extra software or contact other domains by themselves. - Recommended actions: ask the skill author to (1) update twenty-config.sh to look for config/twenty.env (or respect an env var or relative path), (2) declare required env vars in the skill metadata, and (3) remove hardcoded user-specific paths. If you cannot get an updated version, inspect and locally modify the scripts to point to your own config path before running them. Given these coherence issues (hardcoded config path and missing declared credentials), treat the skill as suspicious until those problems are resolved.

Interact with your self-hosted Twenty instance via REST and GraphQL.

Config

Create config/twenty.env (example at config/twenty.env.example):

• TWENTY_BASE_URL (e.g. https://crm.example.com or http://localhost:3000)
• TWENTY_API_KEY (Bearer token)

Scripts load this file automatically.

Commands

Low-level helpers

• REST GET: skills/twenty-crm/scripts/twenty-rest-get.sh "/companies" 'filter={"name":{"ilike":"%acme%"}}&limit=10'

• REST POST: skills/twenty-crm/scripts/twenty-rest-post.sh "/companies" '{"name":"Acme"}'

• REST PATCH: skills/twenty-crm/scripts/twenty-rest-patch.sh "/companies/<id>" '{"employees":550}'

• REST DELETE: skills/twenty-crm/scripts/twenty-rest-delete.sh "/companies/<id>"

• GraphQL: skills/twenty-crm/scripts/twenty-graphql.sh 'query { companies(limit: 5) { totalCount } }'

Common objects (examples)

• Create company: skills/twenty-crm/scripts/twenty-create-company.sh "Acme" "acme.com" 500
• Find companies by name: skills/twenty-crm/scripts/twenty-find-companies.sh "acme" 10

Notes

• Twenty supports both REST (/rest/...) and GraphQL (/graphql).
• Object names/endpoints can differ depending on your workspace metadata and Twenty version.
• Auth tokens can be short-lived depending on your setup; refresh if you get 401.