Classify Customer Intents with AI — Route to Slack & CRM

• Outcome: Review
• Latest audit: Aug 31, 2026 · 1:06 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for classifying customer intent, but it under-specifies risky automation and data-sharing behavior for customer communications and CRM workflows.

Review this before installing in any customer-facing workflow. Use it in recommendation-only mode unless you have explicit approval gates, PII redaction, retention rules, audit logging, and clear consent for sending customer text to OpenAI, Slack, CRM, and automation platforms.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The skill states it only returns recommendations and does not automatically send messages, but elsewhere describes routing to Slack/CRM, triggering notifications, and workflow automation. This mismatch can mislead users about the degree of automation and cause customer communications or escalations to occur without the human review implied by the safety section.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The privacy section claims no storage or logging by default, while other sections describe optional logging for model refinement and daily misclassification logging to Slack. These conflicting statements can cause operators to send customer text into logs or third-party channels under incorrect assumptions about retention and exposure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill encourages routing customer messages through Slack, CRM, Zapier, Make, and custom APIs without a prominent upfront warning that customer content may be transmitted to external services. Because the skill processes support tickets, DMs, emails, and comments, this can expose sensitive or regulated customer data to multiple third parties unexpectedly.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### What This Skill WILL NOT Do
❌ **Make final decisions** → Always flag low-confidence classifications for human review (< 65%)  
❌ **Automatically send emails/messages** → Returns recommendations only; humans control outreach  
❌ **Guarantee perfect accuracy** → Depends on input quality; ambiguous text may score evenly across buckets  
❌ **Access customer data without consent** → Requires explicit permission to analyze; doesn't store or log data (unless configured)  
❌ **Override business logic** → Recommendations are suggestions, not rules; your playbooks take precedence

• Confidence: 84% confidence
• Finding: Although the line claims the skill will not automatically send emails or messages, the broader skill context promotes automated routing and notifications based on model output. In a workflow setting, intent classifications can directly drive downstream actions, so describing the skill as recommendation-only understates the risk of autonomous operational decisions affecting customers and accounts.

Static analysis

No suspicious patterns detected.