ClawHub
Back to skill

Security audit

Personal CRM

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only personal CRM skill whose sensitive data handling is disclosed and aligned with its purpose.

Install only if you are comfortable keeping a local relationship-history file. Store the NETWORK files in a private workspace, periodically review them, and enable calendar, email, Facebook import, or future transcript features only for information you intentionally want retained.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The touchpoint capture triggers are broad, natural-language phrases that are likely to appear in ordinary conversation, which can cause the agent to enter data-capture mode when the user did not intend to log relationship details. In a CRM skill that stores sensitive personal relationship history, this increases the risk of unintended collection and persistence of private information about the user and third parties.

Context Leakage

High
Category
Data Exfiltration
Content
| **Calendar** | Pre-meeting context, post-meeting prompts, birthday import |
| **Email** | Forward emails to log touchpoints, auto-extract email addresses |
| **Gift Tracker** (separate skill) | Link gift history to contacts, suggest gift ideas |
| **Meeting Transcripts** (future) | Auto-extract conversation details from tools like Granola |

---
Confidence
76% confidence
Finding
extract conversation

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.