HK3 CRM 安装器

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 1.0.1

Overview

This CRM installer is mostly transparent about its purpose, but it downloads and runs unpinned remote code and leaves a local background service running.

Review the GitHub repository and requirements before installing, preferably pin or verify a specific commit, run it in a contained environment, and make sure you know how to stop the background CRM process when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises shell-capable behavior by instructing the agent to run a local setup script, clone a remote GitHub repository, install dependencies, and start a service, yet it declares no corresponding permissions or safety boundary. This creates a meaningful trust gap: users may invoke code execution and remote code retrieval without explicit consent or sandboxing expectations, which can lead to arbitrary local command execution through the fetched installer.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script is presented as an installer, but it also updates an existing checkout and launches the CRM as a persistent service. That expands its behavior beyond installation and can cause unintended code changes and process execution in the user's environment without clear consent, especially because the repo content is fetched remotely and then executed.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Starting a background server process from an installer is risky because it creates ongoing execution and potentially exposes a network service when the user may expect only setup steps. In this case, the script uses nohup and backgrounding, making the process persist beyond the install session without robust service management or user approval.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger phrases are broad enough that ordinary requests about installing or downloading a CRM could activate a skill that performs code download and execution. In this context, overbroad activation is dangerous because the skill's action is not informational; it initiates local installation and service startup from a remote repository.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill description omits a prominent warning that it will clone code from GitHub, install dependencies, execute a setup script, and automatically start a local server. Because these are high-risk side effects, failing to disclose them undermines informed user consent and increases the chance of silent execution of untrusted third-party code on the host.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script performs several system-changing actions—git clone/pull, Python package installation, and background process startup—without a clear warning or consent flow. This is dangerous because it fetches and executes remote code and alters the local environment, which increases the risk of supply-chain compromise or unintended system state changes.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.