Security audit
Security checks across malware telemetry and agentic risk
The skill is presented as a concierge router, but it ships broad Fulcra and Attio clients that can read, write, and delete sensitive personal and CRM data beyond what the wrapper README discloses.
Review this before installing if you do not want a concierge wrapper to include direct Fulcra and Attio data clients. Only use it in an environment where Fulcra and Attio tokens, FULCRA_CLI_COMMAND, FULCRA_API_BASE, ATTIO_API_BASE, and FULCRA_CONCIERGE_HOME are controlled and trusted, and prefer dry-run or explicit confirmation for any CRM or annotation mutation.
candidates = [[*shlex.split(command), "auth", "print-access-token"]]
for cmd in candidates:
try:
token = subprocess.check_output(
cmd,
env=env,
text=True,headers["Content-Type"] = "application/json"
req = urllib.request.Request(url, data=data, headers=headers, method=method)
try:
with urllib.request.urlopen(req, timeout=30) as resp:
body = resp.read().decode() or "{}"
return resp.status, json.loads(body)
except urllib.error.HTTPError as exc:env.setdefault("PYTHONUTF8", "1")
cmd = [*shlex.split(CLI_COMMAND, posix=(os.name != "nt")), *args]
try:
proc = subprocess.run(cmd, env=env, text=True, capture_output=True, timeout=120)
except (FileNotFoundError, subprocess.TimeoutExpired) as exc:
return 1, f"CLI invocation failed: {exc}"
if proc.returncode != 0:data[name] = value
# Write atomically-ish and restrict perms before writing the value.
tmp = SECRETS_PATH.with_suffix(".tmp")
with open(tmp, "w", encoding="utf-8") as fh:
json.dump(data, fh, indent=2)
try:
os.chmod(tmp, 0o600)headers["Content-Type"] = "application/json"
req = urllib.request.Request(API_BASE + path, data=data, headers=headers, method=method)
try:
with urllib.request.urlopen(req, timeout=30) as response:
body = response.read()
return response.status, body.decode() if body else ""
except urllib.error.HTTPError as exc:def run_cli(args: list[str]) -> tuple[int, str]:
env = os.environ.copy()
env.setdefault("PYTHONUTF8", "1")
cmd = [*shlex.split(CLI_COMMAND, posix=(os.name != "nt")), *args]
try:def access_token() -> str:
env_token = os.environ.get("FULCRA_ACCESS_TOKEN")
if env_token:
return env_token.strip()if env_token:
return env_token.strip()
env = os.environ.copy()
env["HOME"] = DEFAULT_HOME
command = os.environ.get("FULCRA_CLI_COMMAND", "uv tool run fulcra-api")env.setdefault("PYTHONUTF8", "1")
cmd = [*shlex.split(CLI_COMMAND, posix=(os.name != "nt")), *args]
try:
proc = subprocess.run(cmd, env=env, text=True, capture_output=True, timeout=120)
except (FileNotFoundError, subprocess.TimeoutExpired) as exc:
return 1, f"CLI invocation failed: {exc}"
if proc.returncode != 0:stdlib-only (urllib) so it runs under any `uv run`/python without extra installs, mirroring the Fulcra annotation helper. It is BOTH a library (import the functions) and a CLI (skills shell out to it). Every write supports --dry-run, and the token is loaded via concierge_secrets (env ATTIO_API_KEY or ~/.fulcra-concierge/secrets.json) and never printed. Attio shapes used (verify against the live API; envelopes are the documented ones):
2. ~/.fulcra-concierge/secrets.json -- the persistent local store. Secrets are never printed. Skills read keys through `get_secret`; they should not open secrets.json themselves. Keeping one loader means one place to harden (file perms, future keychain support) instead of N copies across skills. """ from __future__ import annotations
import os
from pathlib import Path
SECRETS_PATH = Path(os.environ.get("FULCRA_CONCIERGE_HOME", Path.home() / ".fulcra-concierge")) / "secrets.json"
def _load_file() -> dict:def set_secret(name: str, value: str) -> None:
"""Persist a secret into secrets.json (merging with any existing keys) and
lock the file down to the current user. Used by setup helpers, not skills."""
SECRETS_PATH.parent.mkdir(parents=True, exist_ok=True)
data = _load_file()Secrets are never printed. Skills read keys through `get_secret`; they should not open secrets.json themselves. Keeping one loader means one place to harden (file perms, future keychain support) instead of N copies across skills. """ from __future__ import annotations
62/62 vendors flagged this skill as clean.
No suspicious patterns detected.