Heleni Personal CRM

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:33 AM UTC
• Version: 1.0.0

Overview

This personal CRM skill is mostly purpose-aligned, but it asks for recurring access to calendar, email, CRM data, local credentials, and outbound WhatsApp briefings in ways that need careful review.

Review before installing. Use only with dedicated least-privilege Google and monday.com access, replace the hardcoded personal values with private configuration, avoid sourcing executable .context files, require confirmation before WhatsApp messages, and document how to inspect and remove the daily cron task.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:91

Finding

Persistent Daily CRM Synchronization Through a Scheduled Task

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 91-100
Vulnerability Type: T06: System Persistence
Risk Level: High

Vulnerable Code:

bash

openclaw cron add \
  --name "crm-daily-sync" \
  --every 24h \
  --session isolated \
  --message "Run personal-crm skill: sync today's calendar events to CRM board, update Last Contact and Next Meeting for all attendees. If new contacts found, add them. Silent if no changes." \
  --timeout-seconds 120

Technical Analysis

The Skill directs the user or agent to register a recurring OpenClaw cron task. Unlike an operation limited to the current invocation, this task survives the Skill run and automatically executes every 24 hours.

The scheduled instruction accesses calendar information, updates CRM records, and creates records for newly discovered contacts. The --session isolated setting isolates individual runs but does not remove the persistence or limit the number of future executions. The instruction to remain silent when no changes occur also reduces routine visibility into execution.

Daily synchronization is related to the declared CRM functionality, but automatic installation exceeds the privileges required for an on-demand CRM query or one-time synchronization. Persistence should therefore be an explicit, separately authorized feature rather than a default setup action.

Attack Path

1. A user or agent loads the Skill and follows its cron setup instructions.
2. openclaw cron add registers the crm-daily-sync task.
3. The task survives the original Skill session and starts a new isolated run every 24 hours.
4. Each run accesses the configured calendar and monday.com CRM resources.
5. Meeting-attendee information is processed, existing contact records are changed, and new contact records may be created without per-run approval.
6. Processing continues until the scheduled task is explicitly removed, including after the user n ...[truncated 682 chars]

Remediation

View remediation

Remediation Suggestions

• Do not register the scheduled task automatically when the Skill is loaded or first invoked.
• Require explicit, informed user confirmation immediately before running openclaw cron add.
• Clearly disclose the schedule, accessed data, external services, expected record changes, and retention behavior.
• Provide and document the exact command required to inspect and remove the scheduled task.
• Prefer on-demand synchronization by default, with recurring synchronization as an optional feature.
• Support an expiration date, bounded execution count, or periodic reauthorization.
• Use dedicated, least-privileged credentials with read-only Google Calendar access and only the necessary monday.com board permissions.
• Produce an auditable execution log and notify the user of material changes rather than operating entirely silently.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:8

Finding

Arbitrary Shell Command Execution Through Sourced Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-9
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code:

bash

CONTEXT_FILE="/opt/ocana/openclaw/workspace/skills/personal-crm/.context"
[ -f "$CONTEXT_FILE" ] && source "$CONTEXT_FILE"

Technical Analysis

The shell source command interprets the entire .context file as executable shell code in the current process. It does not restrict the file to static key-value configuration. Consequently, command substitutions, function definitions, redirections, environment changes, and arbitrary commands placed in the file execute with the privileges of the Skill runner.

Checking only whether the file exists does not verify its owner, permissions, file type, integrity, or contents. If another account, compromised process, or previously installed component can modify .context, this instruction converts that write access into command execution.

Execution occurs in the current shell, so malicious content can also alter variables such as credential paths, board identifiers, commands, or environment settings used later by the Skill.

Attack Path

1. An attacker or compromised local process obtains write access to the .context file or replaces it at the expected path.
2. The attacker inserts a shell payload, such as command substitution or a direct command, into the file.
3. The Personal CRM Skill executes the documented context-loading commands.
4. source "$CONTEXT_FILE" evaluates the attacker's payload in the current shell.
5. The payload runs with the Skill runner's operating-system privileges and can access resources available to that process.
6. The payload may read local credentials, change synchronization destinations, modify files, or launch additional processes.

Exploitation depends on the attacker obtaining write or replacement access to the context file. The audited file does not ...[truncated 643 chars]

Remediation

View remediation

Remediation Suggestions

• Do not use source to load configuration data.
• Store configuration in a non-executable format such as JSON or a strictly parsed environment file.
• Parse only an explicit allowlist of expected keys, including CRM_BOARD_ID, OWNER_EMAIL, and the documented column identifiers.
• Reject command substitutions, shell metacharacters, unexpected keys, duplicate keys, and malformed values.
• Verify that the configuration is a regular file rather than a symbolic link.
• Validate file ownership and enforce restrictive permissions, such as owner-only read and write access where appropriate.
• Keep credentials in a dedicated secret store rather than allowing a general-purpose configuration file to execute code or redirect credential paths.
• If shell parsing is unavoidable, use a purpose-built parser and assign validated values without evaluating file contents.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:108

Finding

Hardcoded Personal and Infrastructure Information in the Skill Document

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 108-111
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code:

bash

CRM_BOARD_ID="18407279559"
OWNER_EMAIL="[e-mail]"
OWNER_PHONE="[phone]"
GOG_CREDS="/opt/ocana/openclaw/.gog/credentials.json"

Technical Analysis

The Skill document embeds deployment-specific personal information and infrastructure metadata, including an email address, telephone number, monday.com board identifier, and local Google credential-file path.

The snippet does not contain an OAuth token, password, private key, or other authentication secret. Nevertheless, publishing these values unnecessarily discloses personally identifiable information and identifies a likely location for sensitive credentials. The board identifier and credential path can also assist targeted social engineering or follow-on attacks where an attacker already has some local or service access.

These values are not required in a reusable Skill package. The declared functionality can operate with deployment-specific values supplied through protected configuration.

Attack Path

1. An attacker obtains the Skill package, repository contents, audit artifact, or another copy of SKILL.md.
2. The attacker extracts the owner email address, telephone number, board identifier, and credential-file location.
3. The attacker uses the personal identifiers for targeted phishing, impersonation, or unwanted contact.
4. If the attacker later gains limited local access, the disclosed credential path helps locate Google authentication material.
5. If the attacker has relevant monday.com access, the disclosed board identifier may assist in targeting the CRM board.

The disclosed values alone do not provide authenticated access to Google or monday.com. Further access or successful social engineering would be required to compromise those services.

...[truncated 439 chars]

Remediation

View remediation

Remediation Suggestions

• Replace all deployment-specific values in the distributed document with descriptive placeholders.
• Remove the real email address, telephone number, and board identifier from version-controlled or distributable Skill content.
• Store operational configuration in a permission-restricted configuration mechanism or secret manager.
• Avoid documenting a fixed credential-file path unless it is essential; resolve credential locations through protected runtime configuration.
• Review repository and artifact history for prior exposure and remove personal data where feasible.
• Assess whether the exposed contact details require privacy-response measures.
• Ensure the referenced Google credentials use only the minimum required scopes and are readable only by the intended runtime account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description does not warn that the skill syncs personal contact and meeting data from calendar and email into a CRM board and may send pre-meeting briefings over WhatsApp. This lack of transparency undermines informed consent for collection, storage, and redistribution of sensitive personal data.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs direct use of a local credentials.json file to obtain Google access tokens, exposing a credential access path inside the skill logic. Embedding or operationalizing direct credential-file access in a broadly invocable skill raises the risk of credential misuse, unauthorized API access, and lateral access to calendar or email data.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

Step 1 — Fetch today's calendar events

bash

# Use Calendar API directly (gog CLI auth is broken — use credentials.json)
# See calendar-setup skill for full auth flow
ACCESS_TOKEN=$(...)  # refresh from /opt/ocana/openclaw/.gog/credentials.json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The workflow normalizes refreshing access tokens from a local credentials.json path, which can encourage unsafe handling of long-lived secrets. In the context of a skill that processes personal calendar and email data, compromise of those credentials enables broad unauthorized access to sensitive communications and schedules.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

bash

# Use Calendar API directly (gog CLI auth is broken — use credentials.json)
# See calendar-setup skill for full auth flow
ACCESS_TOKEN=$(...)  # refresh from /opt/ocana/openclaw/.gog/credentials.json

TODAY=$(date -u +%Y-%m-%d)
TOMORROW=$(date -u -d '+1 day' +%Y-%m-%d 2>/dev/null || date -u -v+1d +%Y-%m-%d)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The .context template includes a concrete secret file path and personal identifiers such as owner email and phone number. Publishing operational secret locations and associated identity metadata makes targeted credential theft and privacy compromise easier, especially in a skill designed to automate access to personal CRM and calendar data.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

CRM_BOARD_ID="18407279559"
OWNER_EMAIL="[e-mail]"
OWNER_PHONE="[phone]"
GOG_CREDS="/opt/ocana/openclaw/.gog/credentials.json"

# Column IDs
COL_EMAIL="email_mm24sjhq"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description uses broad triggers such as 'when someone asks about a contact' or 'before a meeting,' which can match ordinary conversation and cause the skill to activate unexpectedly. In this skill, accidental invocation is risky because it accesses sensitive calendar, email-derived, and CRM data and may perform writes or send briefings.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The pre-meeting briefing explicitly instructs sending CRM-derived notes, relationship context, and contact history over WhatsApp. That creates an additional plain-language disclosure channel for personal information, increasing exposure if messages are misdirected, retained, or viewed on compromised devices.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documentation adds an outbound WhatsApp notification behavior that is not disclosed in the manifest description. That mismatch hides a data-sharing capability from users and reviewers, increasing the chance that contact history, meeting details, and notes are transmitted unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

A personal CRM skill primarily needs to store and retrieve contact context; sending WhatsApp messages is an additional outbound communication channel that expands data exposure. Because the messages include meeting prep details and CRM notes, this capability can disclose personal information beyond the minimum needed for CRM operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document includes operational instructions in Hebrew and English, and later defines manual queries using Hebrew phrases only. This can impose a language expectation without documenting a user choice or stating that multiple languages are supported.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.