Personal CRM Warm-Up
v1.0.0Identifies contacts you haven't reached out to recently and suggests low-pressure ways to reconnect.
⭐ 1· 51·0 current·0 all-time
byPeter Lum@liverock
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description describe a local personal-CRM helper and the code and SKILL.md match that purpose. No unrelated credentials, binaries, or cloud APIs are requested.
Instruction Scope
SKILL.md and handler.js agree that the skill reads contacts.json and produces markdown suggestions. One minor inconsistency: the README mentions an optional custom contacts path passed to the handler, but the skill command as documented does not expose a CLI argument for contactsPath. The handler API does accept a contactsPath parameter (so if the platform allows callers to supply it, the code could load an arbitrary local file). This is a capability not clearly documented as callable in the command reference and is worth noting.
Install Mechanism
No install spec or external downloads. It's instruction-only with a small included Node.js script and package.json; nothing is fetched from the network during install.
Credentials
Only optional environment variables are for per-category threshold overrides (CRM_INNER_CIRCLE_DAYS, CRM_PROFESSIONAL_DAYS, CRM_FRIEND_DAYS, CRM_CASUAL_DAYS). These are proportional and documented.
Persistence & Privilege
The skill is not always-enabled and does not request persistent system privileges. It does not modify other skills or system-wide configuration.
Assessment
This skill appears coherent and local-only: it reads the included contacts.json and formats suggestions and draft messages with no network calls or secret requirements. Before installing or running it: (1) inspect the packaged contacts.json (it contains personal data) or replace it with your own; (2) note the handler exposes an undocumented contactsPath parameter — if callers can pass that, it could be used to read other local files, so avoid giving the skill broad autonomous invocation or passing untrusted input for file paths; (3) run it in an environment with Node.js installed and, if you want extra safety, run it in a restricted container/working directory so it can only read the contact file you intend. If you need help verifying or sandboxing it, ask and I can suggest concrete steps.Like a lobster shell, security has layers — review code before you run it.
latestvk970p56f9bvba3zk9xbmpht4fd84rr6d
License
MIT-0
Free to use, modify, and redistribute. No attribution required.